Overview

overview

7

Static

static

3

d0809381cf...27.exe

windows10-2004-x64

7

d0809381cf...27.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 13:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
  • Size 5.6MB
  • Sample261011-qsdcnaae28
  • SHA256 d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4600
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43C6.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3860
      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:5204
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4740.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5868
          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2984
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C70.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4796
              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1664
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EC2.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:6072
                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:936
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51DF.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4944
                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4316
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55D7.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1320
                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:3156
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5980.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4484
                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2476
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6306.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:1380
                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2684
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65C5.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:5696
                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:3700
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7882.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:5860
                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:4900
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BFC.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:2804
                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:2992
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80A0.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2788
                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3464
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a843A.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:6088
                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2872
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a869B.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5724
                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:6056
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DDE.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2644
                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3280
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91F5.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1984
                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2976
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a958F.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2512
                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1420
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98DB.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2840
                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4548
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BF8.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2284
                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5928
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EC7.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2540
                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:6012
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA195.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2868
                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4040
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA493.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1792
                                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4656
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA56E.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2852
                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1148
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA648.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3760
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3204
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA752.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4112
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5972
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA83C.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5652
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1128
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA956.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4880
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2808
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA40.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1240
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5820
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB3A.bat
                                                                                                                      58⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:5760
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4352
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC24.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2436
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5040
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD1E.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:1616
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:3220
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE18.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:3776
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:4728
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF12.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:5380
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:4552
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFCE.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:1296
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:992
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0B8.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:5352
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:5384
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1B2.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:1316
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:4108
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2AC.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:3888
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:3492
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3B6.bat
                                                                                                                                                              76⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:2264
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:3232
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4A0.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:1716
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:1764
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB56B.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                        PID:5356
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:6092
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB646.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:3000
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:5960
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB76F.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                  PID:5592
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:2548
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB879.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:5668
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                        87⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:4884
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB953.bat
                                                                                                                                                                                          88⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2360
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:4212
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA1F.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:5444
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:1044
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB09.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:2952
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:1268
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBD4.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                        PID:5404
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:5072
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCCE.bat
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:2836
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:1772
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD7A.bat
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                  PID:880
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:4088
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE26.bat
                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                        PID:2032
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:1560
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF10.bat
                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                              PID:1440
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:5992
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFDB.bat
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:1308
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:564
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0B6.bat
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:4980
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:2576
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC172.bat
                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                            PID:988
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:5372
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC23D.bat
                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:800
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:5900
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC317.bat
                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                      PID:1692
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:6060
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3F2.bat
                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                            PID:4068
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:5060
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4CD.bat
                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:3712
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:3272
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC579.bat
                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:5168
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:1388
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC654.bat
                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                          PID:4512
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:3908
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC73E.bat
                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                PID:124
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:5780
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC867.bat
                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                      PID:5176
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:4992
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC970.bat
                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                            PID:4516
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:2044
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA5B.bat
                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                    PID:2392
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB26.bat
                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:1684
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:4624
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC01.bat
                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:4968
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                              PID:5956
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCDB.bat
                                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:2020
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:4964
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDB6.bat
                                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                                      PID:4876
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        PID:708
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE91.bat
                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:2208
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:5344
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF7B.bat
                                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:4940
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:4124
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD056.bat
                                                                                                                                                                                                                                                                                                                                  142⤵
                                                                                                                                                                                                                                                                                                                                    PID:4492
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:5220
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD112.bat
                                                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:5376
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:2276
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1FC.bat
                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                              PID:1932
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5280
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2D7.bat
                                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3332
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1304
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3C1.bat
                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:5036
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                              151⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              PID:4580
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD47D.bat
                                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:2628
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:4424
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD528.bat
                                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2740
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:5228
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5E4.bat
                                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1284
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4092
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6AF.bat
                                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:3552
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2824
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD77A.bat
                                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:6048
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:5300
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD865.bat
                                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3524
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD920.bat
                                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9FB.bat
                                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAD6.bat
                                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5672
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3288
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC8B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5052
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD85.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF4A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE015.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:920
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE286.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE380.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE48A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE545.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE601.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7A7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE872.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE95C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA27.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB12.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECE7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE7D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF48.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF023.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0DE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF294.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF34F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF43A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF67C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF737.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF802.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA64.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB4E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC58.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD13.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDBF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE7B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF75.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a291.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a418.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a502.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a706.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a977.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA42.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF82.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a100F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1260.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a131C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13E7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a155E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15FA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1696.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1742.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4100
                                                                                                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Creates a file in the Startup directory
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                  PID:5792
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                    PID:5232
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:5248

                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1059

                                                                                                                                                                                                                                      Windows Command Shell

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1059.003

                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                      Credentials from Password Stores

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1555

                                                                                                                                                                                                                                      Credentials from Web Browsers

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1555.003

                                                                                                                                                                                                                                      Unsecured Credentials

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1552

                                                                                                                                                                                                                                      Credentials In Files

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1552.001

                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1120

                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                      System Location Discovery

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1614

                                                                                                                                                                                                                                      System Language Discovery

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1614.001

                                                                                                                                                                                                                                      System Network Configuration Discovery

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1016

                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                      Data from Local System

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1005

                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                      $$a43C6.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a43C6.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 c078146dd7e7ff9dced045e42cef6b01d098887e9757be626b6e8cef4aa2da61
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a4740.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4740.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 5e30f9107ce35b405cc3ea14779b4884999c849dea023476bfc7a8b95147e5f4
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a4C70.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4C70.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 3e6d52cffafb2911d7ca53ab8e9309867b57dd5b198789602f47e68541f942cc
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a4EC2.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4EC2.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 d641fa1c55fc3c51f2e075582aa93379e0985f6ea41f244e0d868637be3b6210
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a51DF.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a51DF.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 3081fc59f8bc1e32b8c78e0150e02b33a5546dbc2d6c00f3d9f4f052bd08fd30
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a55D7.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a55D7.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 77f85eaeb00df37df74f08e150ad5087b8ed7e7a395078c9448370c2279c206e
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a5980.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5980.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 80d749b196913c098a9fc94a2aebd985f3ac806eed2b86b5f1e3aa390f1d69ab
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a6306.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6306.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 cc021e62719ee12d58899da4cb3ed5ad504c547f6aa40e055de1c55fedbad5d9
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a65C5.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a65C5.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 328bbdcd42a98f9fac5e2b9dcc744361ad87cac36d097239ae40ad74e45d6bd7
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a7882.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7882.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 ab4c81fe0077b73d028ebcf6a5fa7b74678a17ecb80e8dae1852f0802657f406
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a7BFC.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7BFC.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 44ea8bb3cd0802ab2b87aa7955a9b6c423295d76826f6a0c346200d3f5d193d5
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a80A0.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a80A0.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 66ba0b0964c6361f500997a26cc7423cefb3011bd5ae16345369e76915ba0bad
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a843A.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a843A.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 f2aaaa5c1a3fbc5c616d52e89fa30f1ef2c9d80bee9266634bece81edab3a01c
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a869B.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a869B.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 aefeaa14286868c16a7e1cb5c16416c9a7177d3ef63acfe870ca00f7afb93279
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a8DDE.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a8DDE.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 2b6b85e673749abcfb961354ea20a8b670a508f6d5d9838d5e622bb8ed882ba3
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a91F5.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a91F5.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 4e52d91b0b331a52e950924ee347dd176ceaeca4d4d39839b24347011115cc43
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a958F.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a958F.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 575019809a2db01fb92c6edda6aacc1e84eef9494a61850f9d1a46f86f3f82af
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a98DB.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a98DB.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 911f89e4710ac36afe00f3e2d0943a4bb5f83d934ee693ee05da228d172f021c
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a9BF8.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9BF8.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 d705b5cb3b347c9fdd40d5a358bfb51a16028644f80f23e7692f047b0dc16d7d
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$a9EC7.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9EC7.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 dd850b70fbc1d17f6802d2dcdac3be86164a86dbea47c53a7a34de3f65521fa5
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      $$aA195.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aA195.bat
                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                      • SHA256 3ab3ae38f300fe5cd044b6dcf4bcacf7c38f92a4769b8891f3e5dd40204f27de
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.5MB
                                                                                                                                                                                                                                      • SHA256 926fa0502a885c6b5e98e51a21a510255a63a4319d1492585da540d4decd6921
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.4MB
                                                                                                                                                                                                                                      • SHA256 e53fddaa2fe5877eaea32dc57b43645ed4f8b4aa81a5123d52b26291298037b2
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.3MB
                                                                                                                                                                                                                                      • SHA256 9b8ebb6a5f13a3fd17be16407e45a7a4599d687a4be8d8da20f37ff64f80b15d
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.2MB
                                                                                                                                                                                                                                      • SHA256 7c007e2bffecfb0d3b663567153b21f3f5083424a3534169b6afa84d17583733
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.2MB
                                                                                                                                                                                                                                      • SHA256 1356d5887cf6c66aea51a151838f27dde350115f541eba7038a182055925e962
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.1MB
                                                                                                                                                                                                                                      • SHA256 ac9818a32cf4f2ad347b417b57c5a3b26f53e90dd71c254ad9a752aa196f03e3
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.1MB
                                                                                                                                                                                                                                      • SHA256 47ecd288406c36438bfd8d9c69b6a9bc019d8548fda4ccbff0e6bf0c95cbca1d
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.0MB
                                                                                                                                                                                                                                      • SHA256 1adee37be1691035e2805b2da805451156a5cf01807799df9168cf0293ef91cc
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.1MB
                                                                                                                                                                                                                                      • SHA256 3294252a574bdd9869c7029b89d41772a20060fa54ce7d69ecca957b3364e2c2
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.0MB
                                                                                                                                                                                                                                      • SHA256 0fa41d095730a347830d64b0f0aad3814ad68acaa281b929b021e9ddf19b4c4a
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.3MB
                                                                                                                                                                                                                                      • SHA256 b9e9b8dbcda4294facfdda5e9831e102e2f949078d4dfec627158816ab21b092
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.0MB
                                                                                                                                                                                                                                      • SHA256 bdc476e30cca91e68c3de292f2c2ca1ccd5a7de865ebb4b35d2b921cc9225a27
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.0MB
                                                                                                                                                                                                                                      • SHA256 f7a961d4ec37a6a91f076c2fd99ad5ffbdebd6aa42c8559505e8233b56bafff7
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.4MB
                                                                                                                                                                                                                                      • SHA256 eb7c6196ee3e4cff8c2bdbf85a8ca29e3222d6a2c178585c0e73406d6f110bb0
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.6MB
                                                                                                                                                                                                                                      • SHA256 facd4838cc2936e737849d65d082c8a480e7168abd524e6e55e68717b7d64eb9
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.5MB
                                                                                                                                                                                                                                      • SHA256 b93e4c8348f6a5215f386af6822d982e3445a0398f797b68a58a23845eabea81
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.4MB
                                                                                                                                                                                                                                      • SHA256 635504f011e5dcdb4b3b77afe1e4bffe56ff9c6c42ea75d68269c1b6b6ee00dd
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.3MB
                                                                                                                                                                                                                                      • SHA256 5a647800b0ad7bdb459a1fdf7981985052e9074f28cfcbcf89e1bb410a2f444f
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.5MB
                                                                                                                                                                                                                                      • SHA256 4c621834aa88669af70b8847ea56998cc842d92ebce6794bb9138f7e88aa80b9
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27.exe.exe
                                                                                                                                                                                                                                      • Size 5.2MB
                                                                                                                                                                                                                                      • SHA256 fe250a8d0050db85525cb3e66ed20728ff5d86a92f66c8a091ee2bbafc0fe52c
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      Logo1_.exe
                                                                                                                                                                                                                                      • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                      • Size 32KB
                                                                                                                                                                                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      _desktop.ini
                                                                                                                                                                                                                                      • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                                                                                                      • Size 10B
                                                                                                                                                                                                                                      • SHA256 6f32c14d8a0712d435829019df23525a5b62bb2ca9b24874a6316ec374b3d04c
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      memory/564-8305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/708-8406-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/920-8562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/920-8556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/936-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/992-8196-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1044-8263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1116-8786-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1128-8148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1148-8130-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1208-8709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1248-8814-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1268-8269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1280-8828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1304-8448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1388-8347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1420-8084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1432-8674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1448-8681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1512-8899-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1560-8293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1664-51-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1696-8723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1764-8226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1772-8281-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1940-8716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1944-8702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2044-8371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2056-8962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2060-8646-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2100-8660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2276-8434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2300-8539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2376-8807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2392-8378-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2396-8590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2404-8849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2432-8730-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2476-1848-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2516-8906-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2524-8653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2548-8244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2576-8311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2632-8639-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2684-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2692-8504-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2720-8983-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2724-8877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2736-8891-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2748-8955-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2808-8154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2824-8483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2872-6072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2940-8532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2976-8075-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2984-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/2992-6049-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3068-8793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3092-8941-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3096-8863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3104-8976-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3156-116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3204-8136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3220-8178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3232-8220-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3272-8341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3280-8063-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3364-8604-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3404-8737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3432-8597-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3456-8856-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3464-6062-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3480-8969-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3492-8214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3700-5570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3832-8990-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3836-8800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/3908-8353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4040-8118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4052-8842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4056-8758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4088-8287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4092-8476-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4108-8208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4124-8420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4212-8257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4316-75-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4324-8884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4348-8744-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4352-8166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4376-8927-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4388-8688-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4424-8462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4496-8497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4504-8997-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4544-9004-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4548-8093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4552-8190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4568-8511-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4580-8455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4600-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4600-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4624-8385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4628-8553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4656-8124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4728-8184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4760-8525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4820-8765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4828-8948-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4884-8250-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4900-5579-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4964-8399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/4992-8365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5004-8546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5016-8569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5040-8172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5060-8335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5072-8275-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5148-8695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5204-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5220-8427-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5228-8469-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5272-8611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5280-8441-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5300-8490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5316-8913-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5344-8413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5372-8317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5384-8202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5392-8625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5500-8772-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5564-8583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5620-8920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5632-8779-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5672-8518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5684-8870-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5692-8667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5708-8576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5780-8359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5788-8751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5792-8070-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5792-1843-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5792-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5792-2863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5816-8821-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5820-8160-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5840-8618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5844-8835-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5900-8323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5928-8102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5932-8632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5956-8392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5960-8238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5972-8142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5992-8299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/6012-8111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/6044-8934-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/6056-7737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/6060-8329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/6092-8232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                      Download