Overview

overview

7

Static

static

3

815ea6a73e...af.exe

windows10-2004-x64

7

815ea6a73e...af.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/10/2026, 11:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
  • Size 5.2MB
  • Sample261014-np4pbstyhz
  • SHA256 815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5416
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA246.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5220
      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5264
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA553.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:816
          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4364
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA95A.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4024
              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:5680
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD23.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2152
                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:1408
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFC3.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:620
                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:5008
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB33E.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4244
                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:2980
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB64B.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5616
                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2056
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCE2.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4628
                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:2164
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFB1.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2496
                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:5372
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC435.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2228
                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:4620
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC781.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:5184
                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:3480
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC73.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3320
                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2124
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFBF.bat
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:692
                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1684
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2AD.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4140
                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1804
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD656.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3856
                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2480
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD2C.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1356
                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1200
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE162.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5476
                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1036
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE606.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5228
                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4076
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE692.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5748
                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5236
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9AF.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4288
                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4872
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC20.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:676
                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5216
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE72.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1596
                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5440
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF4D.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5284
                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1828
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF076.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4588
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5720
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1AE.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:5356
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3292
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF279.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:212
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2200
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF364.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1472
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5136
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF400.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:364
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3812
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF48C.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3288
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:2336
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF519.bat
                                                                                                                          60⤵
                                                                                                                            PID:2956
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:2212
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF603.bat
                                                                                                                                62⤵
                                                                                                                                  PID:3696
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:5732
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6AF.bat
                                                                                                                                      64⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:4616
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2444
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF79A.bat
                                                                                                                                          66⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:3308
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5940
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF817.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:4348
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:5572
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF894.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:1868
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:2756
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF911.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:5928
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:412
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF99D.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:1608
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5436
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA2A.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                    PID:5212
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:5852
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAB7.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:384
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:2900
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB43.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                              PID:2864
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:5792
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBD0.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                    PID:1080
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:3004
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC7C.bat
                                                                                                                                                                                        84⤵
                                                                                                                                                                                          PID:4108
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                            85⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:5796
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD08.bat
                                                                                                                                                                                              86⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:2396
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                87⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:4700
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD95.bat
                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:3960
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:5468
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE70.bat
                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                        PID:1844
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:3196
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFD7.bat
                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:5812
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4204
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:1532
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:1228
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14E.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                      PID:2060
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:4448
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a258.bat
                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                            PID:5448
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:5020
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a304.bat
                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:4196
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:804
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a390.bat
                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                      PID:4888
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:2624
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FE.bat
                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:5076
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:1224
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48A.bat
                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:3528
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:1980
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a517.bat
                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:5104
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:3808
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F2.bat
                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                        PID:380
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:4976
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72A.bat
                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:5728
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:5056
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B7.bat
                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                  PID:4556
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:5716
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a891.bat
                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                        PID:4384
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          PID:2476
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93D.bat
                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:528
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:5080
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E9.bat
                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:3240
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:5412
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA57.bat
                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                      PID:1736
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:2992
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF3.bat
                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:3692
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:5176
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7F.bat
                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:5788
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:3488
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1C.bat
                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:5876
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:3648
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA8.bat
                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                        PID:5124
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                            PID:4580
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD45.bat
                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                                PID:6016
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                                    PID:5060
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD1.bat
                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                        PID:2432
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:1020
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9C.bat
                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:2328
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                                PID:5920
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF67.bat
                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                    PID:4400
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:512
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11D8.bat
                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                          PID:5000
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:4956
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1265.bat
                                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                                PID:4640
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  PID:3460
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1311.bat
                                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    PID:3904
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:4632
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13AD.bat
                                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                                          PID:432
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:4420
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1449.bat
                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:1272
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5280
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14E6.bat
                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:3300
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                      151⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:4980
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1592.bat
                                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:5152
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                          153⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5824
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a165D.bat
                                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:5900
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:1728
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1766.bat
                                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3748
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                      157⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1072
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a188F.bat
                                                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1848
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:840
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a197A.bat
                                                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5980
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A45.bat
                                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EAA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F56.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:208
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2050.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5516
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21C7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a231E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3796
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24F3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2892
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a258F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a263B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26C8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2774.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2820.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2968.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A14.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2AA0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BC9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CC3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F34.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a301E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3109.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32AF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a334B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3426.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34E1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3697.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37C0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a383D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3908.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3994.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A40.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AFC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BB7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C63.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CFF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DDA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E67.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a426E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a430A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4462.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a459A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4627.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4702.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AEA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BA5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C70.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DB9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E45.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F10.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F7E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a502A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5124.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51C0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a528B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5552
                                                                                                                                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                        48⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                        PID:5140
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                          PID:4488
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                                                                                                                              PID:2196
                                                                                                                                                                                                            • C:\Windows\Logo1_.exe
                                                                                                                                                                                                              C:\Windows\Logo1_.exe
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                              PID:3672
                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                PID:748
                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:3748

                                                                                                                                                                                                            Network

                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                  $$aA246.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA246.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 6583d8d28ccc6f16667cea82f766458284a0d2196341669a012e45bbebc8f7dd
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aA553.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA553.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 454f8b6f16ef41f3d8c4a701130877170df1c354dce045087801465ecf6461ea
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aA95A.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA95A.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 32d6bec2e0d1ce56d8fd2791c3545460c495ad2c7efc4e2d29a6846c7e4f53c5
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aAD23.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aAD23.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 3a864c8fbcc83abad2cb94606e8a154817be6a7b884841acf0ceccc4c18756e1
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aAFC3.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aAFC3.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 c34f0b68cbabb81e8dbe6948314211ca8e9e1418d5b437d6714e31fc42b6b4aa
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aB33E.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aB33E.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 b7e367515a4512319d1fa8776ffd0568850db1d23ef441a89e947dc975d0c132
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aB64B.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aB64B.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 c5f481c7b3528c96691caa29afdb8c9de72f711362265abc6a6fc8a7b862294f
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aBCE2.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aBCE2.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 8b1a85441c7546c0682bbda33bbf429d5fe5f687cec353fc790c9d84c66d9039
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aBFB1.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aBFB1.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 354145e27ebe35f658732ac0b399b2ceb4b7b222395b5bba7148e7f5b8195035
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aC435.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aC435.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 5f95f0c6d1a174030873d36286cb763be430d7987c281fa2b2d354d0138e5297
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aC781.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aC781.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 f4fe914d06718a02ce460a91815e46e5ad6ffcb295cee58594a89ab516064f0e
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aCC73.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aCC73.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 b1d32b78e5f04d0e3854d98d8ec2881f9cb363d726db778794ec5a0798e0b0b1
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aCFBF.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aCFBF.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 be0fed449c7e95f4f0e2143d93981cea6d045a20656bfa74a6da7e1d35d489cb
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aD2AD.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aD2AD.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 35f5b3d0321ca650730bc0bde7a1b6ab1205956768e5f59482b8daf319e3b00c
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aD656.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aD656.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 76fb638dcb9b2de839a0bdbab94eff2278540032bc2ffaf2db943d128aa1c50e
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aDD2C.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aDD2C.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 c99a9e78fc4ec2bcf3c1b822a81d27a87469780470935fa21ba4df2ea21e7085
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aE162.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aE162.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 54c4e317a831122977f421ab50699adbf5d63ad8441fa57a5886f5d216dacca5
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aE606.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aE606.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 66da2ccf04be0180e80704d7093f64136cfd9560943fca01449ae564489521bb
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aE692.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aE692.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 c9cc8194c017334288014804b6b40784b2e574b144ee25caabd0af249b11e2d7
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aE9AF.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aE9AF.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 e2a9e78e4945e119386a62052037fc134fd4f075a3096032124ef84a0651ba10
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$aEC20.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aEC20.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 3d1d0fe185b284b8fa79a426a459fbee21130c2e807418c15a204df89ebf896e
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                  • Size 4.6MB
                                                                                                                                                                                                                  • SHA256 44cdb16310bdc8f64830d355fee0b5dfe6418b24ae7649006b35d91bb1212f86
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                  • SHA256 33f8065f5255ae51cf4077b87d26bcaefb8c15c614ae8140a33b228910eb3226
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                  • SHA256 f8e3a56229a0bff5d2335f81cd0083eec0188a8fd30e55e6a150da5e9a187e7c
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 4.9MB
                                                                                                                                                                                                                  • SHA256 7c912e14fd664b9fad10538f43f2c21711296d0912ca0fdcfec22033bb94f152
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 4.9MB
                                                                                                                                                                                                                  • SHA256 927354968cbfff6a16d790586d5d2709e3b3c7ffc81948817cdcd04439a9ffd2
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 4.9MB
                                                                                                                                                                                                                  • SHA256 a36cd86feca886caca8323b017a279a11cddec8a4848c79ddcecaabacf341897
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 4.8MB
                                                                                                                                                                                                                  • SHA256 4e4374b20b7d2f10f3105fc7c2f3cb680b9c089b7c8e3c15189d4509ef7b4d61
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 4.7MB
                                                                                                                                                                                                                  • SHA256 7d38daf3f272f04b3d982c2328a0807a59bfd4400182a626c092afa002001c60
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 4.7MB
                                                                                                                                                                                                                  • SHA256 c460da00c14067791cdeaa0da5ea3d6086248d91a4ede0df69c4e22638898b98
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 5.2MB
                                                                                                                                                                                                                  • SHA256 05cdfc29aa70bf7ee718ffb1d3e47ce9818364f1d0fc68b18f04a8efb7d1b95f
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                  • SHA256 e867c26310c34d8701f395af096f9b0b5451defd2bd1a47ab1b71dad4969edf5
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                  • SHA256 1ac2f549c0f21239164e1b7535cd14b52c98f3b6af693421aa3131aaf8f16070
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                  • SHA256 33f0f5ec5b583bcd79cc48a00278614771bbb6412074917eae7176917ae85487
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 4.8MB
                                                                                                                                                                                                                  • SHA256 d842280ddbf547d1f857d1cdd4444419ab28213622cc9ecbcad8f88d2a427756
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 4.8MB
                                                                                                                                                                                                                  • SHA256 3e31e5d651c0b28e23693e7cbbea642100a4cca125f87da62f19b8bd12c8f977
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                  • SHA256 774b74ef5d5dcd686a98d0a25723b3be1069e5d556cd592609998a7d08ae7488
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 4.6MB
                                                                                                                                                                                                                  • SHA256 49186cfec76e6f45badd8a402fc583c1c0d0c5f2b8dbc057c1d5e35874cb3ca8
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                  • SHA256 8b6ae25b1d842dab0bfc843137ca4fe64836e6536893179667eb7a01a1e705d4
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 4.7MB
                                                                                                                                                                                                                  • SHA256 a63394de8e5224b3769e50cc632e93184eca9ce9d6557a8c6987ffad0bacecf7
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                  • Size 4.6MB
                                                                                                                                                                                                                  • SHA256 c477d5bcfb9327207665915b83c1ba9cd31c21c9cd9ccde4d50684dd44d0c957
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  Logo1_.exe
                                                                                                                                                                                                                  • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                  • Size 32KB
                                                                                                                                                                                                                  • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  _desktop.ini
                                                                                                                                                                                                                  • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                  • SHA256 3cc655fb77d8ee9d3bd8d6ef6851f203306a7e76fc6c88010f361a7375fe8836
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  memory/412-3129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/440-3523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/512-3300-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/532-3686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/536-3571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/624-3493-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/660-3625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/712-3439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/804-3199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/836-3601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/840-3361-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1020-3288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1036-3016-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1072-3355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1124-3403-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1200-3008-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1224-3209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1228-3184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1308-3704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1388-3656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1396-3373-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1408-54-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1508-3668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1656-3409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1684-2120-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1728-3348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1804-2334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1828-3062-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1936-3644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1980-3214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2056-387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2100-3638-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2124-1928-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2164-919-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2200-3077-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2212-3097-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2220-3698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2320-3607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2336-3092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2444-3108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2460-3758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2464-3487-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2476-3239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2480-2846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2504-3445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2576-3776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2624-3204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2756-3124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2900-3144-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2912-3778-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2912-3783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2980-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2992-3254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3004-3154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3076-3674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3196-3174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3204-3613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3248-3770-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3256-3722-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3292-3072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3332-3752-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3460-3312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3476-3553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3480-1920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3488-3264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3508-3728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3548-3547-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3648-3270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3652-3469-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3672-3053-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3672-1684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3672-659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3672-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3780-3716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3784-3541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3808-3219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3812-3087-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3832-3463-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3976-3764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4008-3734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4036-3535-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4076-3024-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4172-3710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4176-3662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4204-3179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4264-3391-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4276-3559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4292-3385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4304-3517-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4364-31-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4376-3421-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4420-3324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4448-3189-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4452-3595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4464-3415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4500-3583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4580-3276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4620-1427-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4632-3318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4668-3451-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4676-3427-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4700-3164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4784-3680-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4800-3379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4872-3040-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4920-3481-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4956-3306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4976-3224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4980-3336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4996-3529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5004-3692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5008-66-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5020-3194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5024-3367-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5056-3229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5060-3282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5080-3244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5084-3505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5128-3565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5136-3082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5140-3110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5164-3650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5176-3259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5216-3046-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5232-3475-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5236-3032-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5264-21-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5280-3330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5300-3457-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5344-3746-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5372-1303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5412-3249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5416-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5416-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5428-3577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5436-3134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5440-3051-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5468-3169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5488-3499-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5512-3632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5520-3740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5572-3119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5624-3433-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5676-3589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5680-46-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5692-3511-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5716-3234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5720-3067-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5732-3102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5792-3149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5796-3159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5824-3342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5852-3139-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5920-3294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5940-3114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5960-3397-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5992-3619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download