Overview

overview

7

Static

static

3

b79aafdf0f...2f.exe

windows10-2004-x64

7

b79aafdf0f...2f.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/10/2026, 12:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
  • Size 6.6MB
  • Sample261011-pwdbdshg86
  • SHA256 b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4376
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE28B.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:852
      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2076
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE52B.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5096
          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4768
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8E4.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3380
              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2948
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED97.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3132
                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:2992
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF141.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4148
                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2044
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF46D.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2304
                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:3552
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF807.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3528
                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:3564
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC1E.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1748
                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:5768
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CB.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:5880
                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:5068
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a788.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:5140
                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:4760
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA5.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:2820
                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:2700
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF19.bat
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4396
                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2444
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1563.bat
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5148
                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5296
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18AE.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5328
                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5536
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C87.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5568
                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5840
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2021.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5844
                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:6024
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a233E.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:6004
                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2220
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26C8.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4260
                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3144
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A52.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4272
                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:6108
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E3A.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1216
                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3276
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E98.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1736
                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2496
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F15.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5896
                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2336
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FB1.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4948
                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3264
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a303E.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2628
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2560
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30BB.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:212
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4032
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3138.bat
                                                                                                          52⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2792
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4068
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31D4.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3976
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1832
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a329F.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:556
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2924
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a333B.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4152
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:1820
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33E7.bat
                                                                                                                          60⤵
                                                                                                                            PID:4504
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4712
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3474.bat
                                                                                                                                62⤵
                                                                                                                                  PID:5164
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:5104
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3500.bat
                                                                                                                                      64⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:5124
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:1752
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a357D.bat
                                                                                                                                          66⤵
                                                                                                                                            PID:1084
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:5212
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3629.bat
                                                                                                                                                68⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:2036
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:5496
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a385C.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:5904
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:5544
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38E8.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:5408
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:5836
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3975.bat
                                                                                                                                                              74⤵
                                                                                                                                                                PID:5860
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:5012
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A11.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:3296
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:2864
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A8E.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:6048
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:3008
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B59.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:4252
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:6084
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C25.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:4808
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:4016
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C92.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                        PID:4692
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                          85⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:5024
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D0F.bat
                                                                                                                                                                                            86⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:4788
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:3932
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a400D.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                  PID:1372
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:940
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40F7.bat
                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                        PID:1680
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:2772
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4184.bat
                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:564
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4308
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a429D.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:944
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:4884
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43A6.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                      PID:5100
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:2704
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4452.bat
                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                            PID:2540
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:3516
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44DF.bat
                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                  PID:2392
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:3340
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45AA.bat
                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                        PID:884
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:5136
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4617.bat
                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                              PID:4264
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:3316
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4694.bat
                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                    PID:5776
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:1984
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4750.bat
                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:1956
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:5456
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47DD.bat
                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                              PID:5888
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:5392
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4944.bat
                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:5692
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:5988
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A1F.bat
                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:5512
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:5972
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B09.bat
                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                            PID:5656
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:5788
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C70.bat
                                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:924
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:6072
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CFD.bat
                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                      PID:3800
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:6128
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D8A.bat
                                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                                            PID:2888
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:4448
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E16.bat
                                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                                  PID:876
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                    125⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    PID:448
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EB3.bat
                                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:2248
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:4476
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F3F.bat
                                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                                            PID:4972
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                                                PID:2692
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5039.bat
                                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                                    PID:2684
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:4588
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50C6.bat
                                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                                          PID:2352
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                                              PID:3440
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5133.bat
                                                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:1096
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                                                    PID:4864
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a520E.bat
                                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:2788
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:4512
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52F8.bat
                                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                                            PID:4600
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                                                                PID:1176
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53A4.bat
                                                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:3740
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5160
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5412.bat
                                                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:4872
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4732
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a548F.bat
                                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5500
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5200
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a554A.bat
                                                                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5696
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5552
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55F6.bat
                                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5976
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5412
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5692.bat
                                                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5968
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5876
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a572E.bat
                                                                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58E4.bat
                                                                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5980.bat
                                                                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A99.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:568
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2148
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C20.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D0A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DA7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E43.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4092
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EDF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F7B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6027.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6121.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a620C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6298.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6344.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a647D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6519.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6586.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6613.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a678A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6826.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68B3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6920.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69FB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B53.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BEF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C8B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D56.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E02.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E7F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FC7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7054.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70E1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a716D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7229.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7352.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7555.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a769D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7797.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7872.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A37.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AD3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B60.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C3B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CE7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DD1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E5E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F29.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FA6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8071.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a819A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8217.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8294.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8311.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a835F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a839D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83EC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a843A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8497.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8505.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85A1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a865D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8766.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8870.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A35.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AC2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B6D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BEA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C77.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D13.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D90.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E1D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F17.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9011.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a907E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90EC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9169.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91D6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9282.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              342⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  343⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a935D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    344⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        345⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            346⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              347⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9428.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                348⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    349⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      350⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        351⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9531.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          352⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              353⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a958F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  354⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      355⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95DD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          356⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            357⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a967A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              358⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  359⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9706.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      360⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          361⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9754.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            362⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                363⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    364⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      365⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a984E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          366⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            367⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98AC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                368⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  369⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9929.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    370⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        371⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            372⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              373⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A13.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                374⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    375⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AA0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        376⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            377⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AFE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                378⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    379⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B6B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        380⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          381⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BC9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              382⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                383⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C56.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    384⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        385⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CC3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            386⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                387⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                                                                                                      29⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5496
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                  PID:1784
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                    PID:4856
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4788
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 988
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                                                                                      PID:980
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1784 -ip 1784
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:776

                                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                                        $$a1563.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1563.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 15a1638cb1e31b267a05be6a8b5388c438484c6498be545c57befc69984519ad
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        $$a18AE.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a18AE.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 d61bba684c1541fece6ccd203fc706e612cac37b7970edced98bf731ef0f464a
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        $$a1C87.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1C87.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 7fd5faa21f1d6c3a0a5ac3b9415529cbc02b23205c4b39883d83c890368c1d34
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        $$a1CB.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1CB.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 721B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 fd4aa7b5b7fbc6c053dc720e4bd4b2254de82ec1ad61e2734a8e4be8aed450a2
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        $$a2021.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2021.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 00ddc36ee8255f7285e2df77224951cfd7fee818c447824ed393539c554a0cf5
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        $$a233E.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a233E.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 185d60021088a8026e41c72ee95580e975ffc0391b911744f1d3f49e1c58247b
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        $$a26C8.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a26C8.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 9e7953d160045b1e31fa6dbc4fea7d3ffdfb2905b195bd4f9690cb681c2305bf
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        $$a788.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a788.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 721B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cab5e5890aff89e792c325a73f4ba3d74616eceab73b605ff39ef9470c931933
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        $$aAA5.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aAA5.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 721B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 5fb0c4c57ef5fd18f0928e2fed1c5977a507d004ab41b48c4178f58b0f22b95a
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        $$aE28B.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE28B.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 3889a574d726c5801650a0ca95e28b86f4cd742f9fa48d5574d45f908cb809b4
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        $$aE52B.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE52B.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8bce604b459291eec83f1b49b2db6adf788f1aa731a6fefa05d27122603e6a6c
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        $$aE8E4.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE8E4.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 2fb200679fc979271721eb919404c4798da53c20e88ba6059cc32be2655647c9
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        $$aED97.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aED97.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 e7403694d9561ce0df4e78768d337898aa55b8dd271d5542262d3139dbd95090
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        $$aF141.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aF141.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 4ec5398189c958bcd224a90372ac6b2e2fdc0b4fbb9ad6967070d48f8b05b6aa
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        $$aF19.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aF19.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 721B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 2f82522673a615ed8413645da3f964e78915ed965f811af83491bba2eb288c40
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        $$aF46D.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aF46D.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 182047bd2aea957fb6ab7e8bd225cf7b875c26296a4459e100208cf28d177c1e
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        $$aF807.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aF807.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 f8d4cb57610026390ce34b8520f25147ad873e2385756d62fb29160b7c109879
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        $$aFC1E.bat
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aFC1E.bat
                                                                                                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 e497f2ecaa2ca3843c6f685d9bb03d7743c141f4992fffe2679e50181ab84eae
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.5MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 10b4f6799b022ed0d9a4f6246951f7bba2857a3d25b91f6832efe0fcc59fa6eb
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.4MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 a3ec31726baf63954adc1a31184161421ce3e6e8567ebbd54d3c016fc5ddb5c5
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.4MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 265cf15b0132e0f1806d0b8dadf350879e0326776b2bdb826eb40979726a0e2f
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.3MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 ef73923761c6ec1f2d92cf38fc725b47a3b304367657c643de18feafccacb7b2
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.3MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 3b863424de615f0b1f8e833a9e350132a95818a96a41445ee74587a389856042
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.2MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 0e01f4d13cd1f3ad4706e3b00ff9663fa81770e65b233fc06bab6a825ab2b390
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.2MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 fd2724fe6f46af4c98d70eaf540ff1d74429c988a393d2651f105e6e560e68f6
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 5a2751be10dc67ce2c8d7b471738aad09933b594bf006ee992b154d70b0391b9
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.3MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 73b924f22720aa6a6e955ab3378edef5fe7d1443f20c5776fa7cfea8b7715bbd
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.2MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 02d429d18cc069e6cb29eee4c1171e82d57e19f685d79be42b5185ed81c29f8f
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.5MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 316a6f66c23496c86043dcb697a3998fbdd509f930d2730aab30f8258a0a0356
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.5MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 77c0c2ffcce1bea6b9b10691430e2c75972e50c8db95004a06964735335415cb
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 02ec66e2adf78543d584e6c484fb6d87e270ccca27b8b8b631625fb239010bd5
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 25ba1858c3c8a06e6b125bf807325878c1ea2a648abff5d3278da520a18a0b85
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.4MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 86e679ed4c386b634c59eae49031fcc13ab5b3315a7352d5479998f0f945d7b7
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.0MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1f5ad2382288362d9cf1b5980308baf9254df049cc673ef5aa9bd6f766eee01e
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.0MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 538eca4763613e5a3a01de5852aceecef566deb9ce9941109eda1cc99b6c3d7f
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b79aafdf0f0129c24fb205f1e511a17443f03ff928055a0ea61f87808c03522f.exe.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 6.6MB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 d8491bbbece9a3689c8ba40b3d00750010de427322b9cd04d8fb3097685762f1
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        Dll.dll
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                                                                                                                                                        • Size 68KB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                                        • Size 32KB
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        _desktop.ini
                                                                                                                                                                                                                                                                                                                                                                        • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                                                                                                        • SHA256 6f32c14d8a0712d435829019df23525a5b62bb2ca9b24874a6316ec374b3d04c
                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                        memory/448-3208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/692-3400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/756-3388-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/940-3118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1176-3250-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1316-3683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1320-3310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1624-3623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1644-3376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1664-3418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1752-3057-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1784-2205-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1784-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1784-2926-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1784-1127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1808-3334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1820-3042-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1824-3677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1832-3032-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1896-3539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1940-3551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1972-3485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/1984-3163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2044-69-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2052-3527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2076-22-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2076-18-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2220-2978-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2336-3007-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2420-3587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2444-2898-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2496-3001-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2512-3322-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2560-3017-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2588-3689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2680-3605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2692-3220-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2700-2395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2704-3138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2720-3491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2772-3123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2784-3611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2864-3087-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2924-3037-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2932-3364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2948-47-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/2992-59-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3008-3092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3144-2986-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3168-3509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3256-3695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3264-3012-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3276-2996-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3280-3671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3312-3575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3316-3158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3340-3148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3440-3232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3476-3521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3516-3143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3536-3340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3552-107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3564-342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3688-3713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3732-3443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3748-3425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3824-3665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3876-3437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/3932-3112-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4016-3102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4032-3022-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4068-3027-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4092-3346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4224-3701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4236-3725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4268-3304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4308-3128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4324-3316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4376-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4376-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4388-3599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4448-3203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4476-3214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4488-3533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4500-3581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4512-3244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4552-3737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4588-3226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4684-3328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4708-3455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4712-3047-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4728-3545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4732-3262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4760-2209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4764-3406-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4768-32-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4796-3412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4800-3449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4864-3238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4884-3133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4904-3431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4908-3358-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4916-3292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/4976-3617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5012-3082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5024-3107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5044-3497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5064-3593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5068-1858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5084-3515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5104-3052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5136-3153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5160-3256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5184-3352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5200-3268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5204-3569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5212-3062-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5220-3473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5248-3394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5268-3707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5296-2939-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5352-3467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5368-3114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5368-3003-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5368-2937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5384-3557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5392-3173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5412-3280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5428-3731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5456-3168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5496-3067-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5532-3461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5536-2950-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5544-3072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5552-3274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5596-3370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5688-3719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5768-1490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5784-3563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5788-3188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5800-3629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5828-3479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5836-3077-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5840-2962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5876-3286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5920-3641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5924-3635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5932-3653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5948-3659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5960-3382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5972-3183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5988-3178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/5992-3298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/6024-2970-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/6032-3647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/6072-3193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/6084-3097-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/6108-2991-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/6128-3198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                        memory/6136-3503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                        Download