Overview

overview

7

Static

static

3

16410cbccc...96.exe

windows10-2004-x64

7

16410cbccc...96.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 10:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
  • Size 4.5MB
  • Sample261011-ms248sge39
  • SHA256 16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FAF.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4888
      • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
        "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1256
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a424F.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5228
          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2292
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4740.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1604
              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2712
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D2C.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5144
                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:1104
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a529B.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:6064
                      • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                        "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:5400
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E53.bat
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:5620
                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4264
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6066.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4992
                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:2796
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a745B.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:1756
                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:3100
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7891.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:1148
                                      • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                        "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:5688
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D44.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4124
                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:3816
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a812C.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1936
                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:2928
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a860E.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2980
                                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2964
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EE8.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1236
                                                      • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5380
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9234.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3912
                                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:6104
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a961C.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1988
                                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1056
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9987.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1184
                                                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2296
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CE2.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1896
                                                                      • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4528
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA128.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5448
                                                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5244
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA53F.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5484
                                                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4356
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8B9.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:852
                                                                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1560
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABB7.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1408
                                                                                      • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:3504
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB05B.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3180
                                                                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                            45⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:6024
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB135.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2284
                                                                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2200
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1E1.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5284
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2512
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2DB.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4100
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2092
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB377.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5076
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2440
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB404.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2548
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2064
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4A0.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5904
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2852
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB53D.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4120
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4104
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5C9.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2172
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:2612
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB665.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:5880
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:1712
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB702.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:4736
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3208
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7EC.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:1624
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:5576
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8B7.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:1476
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5104
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB982.bat
                                                                                                                                                70⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4780
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:4956
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA3E.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:912
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:3832
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBACA.bat
                                                                                                                                                        74⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:108
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:2984
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB67.bat
                                                                                                                                                            76⤵
                                                                                                                                                              PID:6008
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:4988
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBE4.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                    PID:5784
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:6000
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC70.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:1772
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:2748
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCFD.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                              PID:432
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:860
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDA9.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                    PID:2184
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:1616
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE74.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:3352
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:3372
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF2F.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:4076
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:3328
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC01A.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                  PID:4308
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:3188
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0F5.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:1260
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:4368
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1CF.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                            PID:3244
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:5752
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC26C.bat
                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:1500
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:2100
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2F8.bat
                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:4652
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:4872
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC394.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                          PID:3044
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:2924
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC421.bat
                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:796
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:5300
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4AE.bat
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:5788
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:4656
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC54A.bat
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:6096
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:5652
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5F6.bat
                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:5644
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:5344
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6E0.bat
                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:4240
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:1792
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC79C.bat
                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:1296
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:3764
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC828.bat
                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                        PID:4756
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:4980
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8B5.bat
                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                              PID:2856
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:2328
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC951.bat
                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                    PID:4904
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:4900
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9DE.bat
                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:5468
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          PID:4228
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA7A.bat
                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:5808
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:5588
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAF7.bat
                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:2544
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:4768
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBB3.bat
                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:6084
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:4512
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC7E.bat
                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:5252
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:5980
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD39.bat
                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                              PID:2432
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:5832
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE14.bat
                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:5264
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:4864
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEDF.bat
                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                        PID:5968
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:3452
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF8B.bat
                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:5948
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:4320
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD056.bat
                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                  PID:4584
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                      PID:2528
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD102.bat
                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                          PID:4784
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:964
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1AE.bat
                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                PID:2500
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                    PID:4268
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD24A.bat
                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:4048
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:1372
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD306.bat
                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                            PID:5188
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                                PID:5032
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3A2.bat
                                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:5360
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1436
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD44E.bat
                                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3168
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:3316
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4FA.bat
                                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1460
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4168
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5B5.bat
                                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:1956
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:5988
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD661.bat
                                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2792
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:680
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6EE.bat
                                                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:3228
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                  159⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:4996
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD77A.bat
                                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:6108
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4452
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7F7.bat
                                                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:6140
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD874.bat
                                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD97E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4092
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA1A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:936
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAD6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB91.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC4D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCE9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD66.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDF2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEFC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF89.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE035.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE18C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE229.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2E4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE380.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE41D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE49A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE507.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE574.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE66E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE768.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE814.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8C0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE94D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA08.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAC4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB7F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECA8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED06.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED73.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDE1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE9C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF09.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF77.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF003.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF080.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF12C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF255.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6088
                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                          2⤵
                                                                                                                                          • Creates a file in the Startup directory
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Enumerates connected drives
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                          PID:4388
                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                            3⤵
                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                            PID:3428
                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                              4⤵
                                                                                                                                                PID:4848

                                                                                                                                        Network

                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                              Reconnaissance

                                                                                                                                              Resource Development

                                                                                                                                              Initial Access

                                                                                                                                              Execution

                                                                                                                                              Command and Scripting Interpreter

                                                                                                                                              1
                                                                                                                                              T1059

                                                                                                                                              Windows Command Shell

                                                                                                                                              1
                                                                                                                                              T1059.003

                                                                                                                                              Persistence

                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                              1
                                                                                                                                              T1547

                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                              1
                                                                                                                                              T1547.001

                                                                                                                                              Privilege Escalation

                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                              1
                                                                                                                                              T1547

                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                              1
                                                                                                                                              T1547.001

                                                                                                                                              Defense Evasion

                                                                                                                                              Credential Access

                                                                                                                                              Credentials from Password Stores

                                                                                                                                              1
                                                                                                                                              T1555

                                                                                                                                              Credentials from Web Browsers

                                                                                                                                              1
                                                                                                                                              T1555.003

                                                                                                                                              Unsecured Credentials

                                                                                                                                              1
                                                                                                                                              T1552

                                                                                                                                              Credentials In Files

                                                                                                                                              1
                                                                                                                                              T1552.001

                                                                                                                                              Discovery

                                                                                                                                              Peripheral Device Discovery

                                                                                                                                              1
                                                                                                                                              T1120

                                                                                                                                              Query Registry

                                                                                                                                              1
                                                                                                                                              T1012

                                                                                                                                              System Information Discovery

                                                                                                                                              1
                                                                                                                                              T1082

                                                                                                                                              System Location Discovery

                                                                                                                                              1
                                                                                                                                              T1614

                                                                                                                                              System Language Discovery

                                                                                                                                              1
                                                                                                                                              T1614.001

                                                                                                                                              System Network Configuration Discovery

                                                                                                                                              1
                                                                                                                                              T1016

                                                                                                                                              Lateral Movement

                                                                                                                                              Collection

                                                                                                                                              Data from Local System

                                                                                                                                              1
                                                                                                                                              T1005

                                                                                                                                              Command and Control

                                                                                                                                              Exfiltration

                                                                                                                                              Impact

                                                                                                                                              Replay Monitor

                                                                                                                                              Loading Replay Monitor...

                                                                                                                                              Downloads

                                                                                                                                              $$a3FAF.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3FAF.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 2d97405d33f410ce636cfb2346d7202f89a711e7e14d911327945448dee8c534
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a424F.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a424F.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 e9ed5ecb2dd85f38a79dd53185a2680aab49d9a63e3b15d8db0cec0faaf5e32d
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a4740.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a4740.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 291bb184f8731e49b8aa997c15f010bf889290e3571ae20f9818a109b6326d0c
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a4D2C.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a4D2C.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 a4b3375042716f4e5bff40b0cdfbf5bd434e5507cb52c6d9d1d186e78220d3fa
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a529B.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a529B.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 92878075fc5459de82b44e4ce19cbdce49efe0778da55daaf6af037c97930a2b
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a5E53.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a5E53.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 34550ed64286587ae429a1c4e7c107cb7b9db90275591539a1a056540fc0328f
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a6066.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6066.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 ec6ff10f8e49eb6890219aa8fcb8787c75bd0b644c601a05e27ffd06b2f0fde3
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a745B.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a745B.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 ed1dc71f76facf50e00dc5abf1e211ab4301343445fe519555fec663d4af238a
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a7891.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a7891.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 0f9b1c43465bc65f973a663ae2712e4dd1f89552862aebee27e31452d3d78c73
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a7D44.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a7D44.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 14f48860ceba6932a7f1c8fb35abf2071287a0ad78823b19fe8f1e26e514bbec
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a812C.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a812C.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 2a444b0de5374f898d1fd1263cf0a0b60f83c25f58f2a5cf850b8929e9998293
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a860E.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a860E.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 8a098f5e1349007821858a6ce698554f387832fe445bbc1850796f92ca6a3afb
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a8EE8.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a8EE8.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 cb5033b3d8abd5725ef6c6846af6c1f18aef56363359a43b7629c81f6563d911
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a9234.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9234.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 22981cf4a2c25e76a5cca2b1942f6d806107b503deb761ce17c2e4df68e96754
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a961C.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a961C.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 7d9261df2512ffde68324271e887afd997874e761e29fd3163da39bf732ece5a
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a9987.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9987.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 74e89cecd1181029cba230fd7a8d8ec42a8d0446b7cdb9a21b7e52c029b834ce
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a9CE2.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9CE2.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 aca44b5bd42f5c5fd08da7d8f951ef5f604d45df0c6271b1a49e18874ff25f44
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aA128.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aA128.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 3a426d548cbb0d3d939df63bcafa18800c5ce41d5c760136b05dd7646ec469a2
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aA53F.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aA53F.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 5d656f3efa28d4a52595d60f4959e7db7d1331a137dd7583617eabcaa6701818
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aA8B9.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aA8B9.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 929e519a0439a6d2a7605f62908c2ebb2169248f36f9b59392e1b63384af625c
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aABB7.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aABB7.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 ec3a61bd75095c8006a7c3e884cdf903cc65a0a1b201eb58573f31c4d7fb7cd4
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.3MB
                                                                                                                                              • SHA256 8089cfa9917ef667ff6b2f2bde047f6b5bd0077e026131ffa4aab9c3f5a4852e
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 b9bb30c937521a62d179991a05b5762472447e99a9773883346e4e072bf2a3d7
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 e6ad86636526c246882c5884250667d3a30b8201dcb042af4ecdd6ea17137634
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 2646df6906c1620793983b5a5efabec5d10ef357cc024ff609f8d49129a11757
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.1MB
                                                                                                                                              • SHA256 fe79f21dc26e01414ce511868e28b15cc947cb2f96a4d1ab23ead0138a987220
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.1MB
                                                                                                                                              • SHA256 8f09a24359d512594b64bd54f82fb33c5a6b4c0d3724d692461315ac5691b2e8
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.1MB
                                                                                                                                              • SHA256 797b428cea459ef8e1640c5cdecdae4e9854a767f1537feb72285161e43ca52e
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.0MB
                                                                                                                                              • SHA256 fceb9972990514be4ac360b75c608ec9d1d899c8e009b59787ad574037c4e12a
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.0MB
                                                                                                                                              • SHA256 e9246054e887afb82b4511afd613bd234c902fbd969dd6a75cbd55e01257b86f
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.3MB
                                                                                                                                              • SHA256 322b234196b4c21ebd602738db353fea93379cda59b7e65ffa3dce11aeb9f997
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.0MB
                                                                                                                                              • SHA256 3c32a6f45ae80a4b0861c1431c9d9b0f5aa75d5aa507937ba2a388cfaf9ac11b
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 3.9MB
                                                                                                                                              • SHA256 35989272439118b5b9954f3bae7e121d522454fa0d2512d36842fe7bd809083a
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 3.9MB
                                                                                                                                              • SHA256 ab41601142233598d73c78238cddf07264cca524a7f93e4dfe306d7ca16bfeba
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.5MB
                                                                                                                                              • SHA256 42daa9a3e0dd99dbecafaf896cf2e6a46acfcaea5a7052151354867a1e56b45e
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.4MB
                                                                                                                                              • SHA256 d43677e76d2f5fb457b4c2ecf94c33d101214eb30bfa4374192d5c64c051fd73
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.5MB
                                                                                                                                              • SHA256 14929dc019c0f0ff38769519373130eb724f42ce6c0202f0533b19f134983a64
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.4MB
                                                                                                                                              • SHA256 d9d42f0b1fe306424cb6ade571314bac3267d499c88c712170995b40b682f781
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.4MB
                                                                                                                                              • SHA256 2062546ed85c7d6ed0add9e205cd4b83a88b0a293e31d8007f2945f058064e2f
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.3MB
                                                                                                                                              • SHA256 c2b0de61606c465027fdfb8d5f0bfbb2f7e34911a4e2dbb54ae3a69f54f64809
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16410cbccca5aec5d3a720cc4e13ebfc11b275c6308e7f0bbbc29378f6eac396.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 79badd4b8b3ddba4e60ef89740aa3ae419f0ffa830022de4525396adb566c595
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Logo1_.exe
                                                                                                                                              • Path C:\Windows\Logo1_.exe
                                                                                                                                              • Size 32KB
                                                                                                                                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              _desktop.ini
                                                                                                                                              • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                              • Size 10B
                                                                                                                                              • SHA256 6f32c14d8a0712d435829019df23525a5b62bb2ca9b24874a6316ec374b3d04c
                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                              Submit Download

                                                                                                                                              memory/680-8575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/860-8336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/964-8519-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1052-8863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1056-8167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1104-66-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1252-8674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1256-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1312-8709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1336-8631-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1372-8533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1392-8758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1436-8547-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1496-8884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1512-8919-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1552-8779-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1560-8212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1616-8342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1712-8276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1792-8420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1828-8905-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1900-8751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1924-8821-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2064-8251-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2092-8239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2100-8378-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2112-8814-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2180-8835-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2200-8227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2292-36-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2296-8176-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2320-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2320-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2328-8438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2440-8245-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2444-8716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2464-8596-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2512-8233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2528-8512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2580-8912-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2612-8270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2712-55-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2748-8330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2796-5340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2852-8258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2876-8695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2884-8681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2924-8390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2928-6329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2960-8891-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2964-8138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2984-8312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3100-5559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3120-8610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3188-8360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3208-8282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3216-8702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3256-8624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3316-8554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3328-8354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3372-8348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3400-8723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3432-8877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3440-8730-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3452-8498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3488-8807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3504-8215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3516-8927-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3516-8921-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3584-8856-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3664-8744-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3756-8646-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3764-8426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3788-8828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3816-6042-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3832-8306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4092-8617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4104-8264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4132-8849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4168-8561-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4228-8450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4264-1839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4268-8526-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4320-8505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4356-8203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4368-8366-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4388-1541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4388-8133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4388-2671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4388-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4388-8253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4452-8589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4464-8898-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4512-8470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4528-8185-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4588-8653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4656-8402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4752-8786-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4768-8463-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4788-8800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4860-8842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4864-8491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4872-8384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4900-8444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4944-8870-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4956-8300-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4980-8432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4988-8318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4996-8582-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5032-8540-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5104-8294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5244-8194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5300-8396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5344-8414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5356-8639-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5380-8149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5400-1830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5576-8288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5588-8456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5652-8408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5688-6029-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5700-8603-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5752-8372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5800-8667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5832-8484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5876-8660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5916-8737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5928-8688-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5940-8772-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5956-8765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5960-8793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5980-8477-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5988-8568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6000-8324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6024-8221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6104-8158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download