Overview

overview

7

Static

static

3

815ea6a73e...af.exe

windows10-2004-x64

7

815ea6a73e...af.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/10/2026, 11:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
  • Size 5.2MB
  • Sample261014-np4pbstyhz
  • SHA256 815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4948
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3399.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3128
      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2664
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a354F.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5752
          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4336
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4201.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1980
              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:5332
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4944.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1424
                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5844
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C7E.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3804
                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2768
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62D7.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5688
                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:2144
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6865.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3296
                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:1656
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C2D.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3256
                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:5516
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F0C.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:1716
                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:2708
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74A9.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:6096
                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:4140
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77A7.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1888
                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:4652
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A47.bat
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4240
                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4360
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F29.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3364
                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3264
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8708.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:244
                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4080
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89D7.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5736
                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2724
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C19.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:6032
                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2932
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F65.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5160
                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5860
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a912A.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1492
                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2108
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a933D.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2712
                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4864
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95AE.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1640
                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1504
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97F1.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4672
                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4228
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A13.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1748
                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5880
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AEE.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4592
                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2320
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BF8.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4300
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4072
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D11.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1808
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:6128
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F63.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2576
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5040
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA03E.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5804
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4320
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA147.bat
                                                                                                                  56⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5380
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4480
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA232.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:5248
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:5236
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA31C.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4988
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:500
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3D7.bat
                                                                                                                              62⤵
                                                                                                                                PID:3656
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5056
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4C2.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:4444
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:5228
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA59D.bat
                                                                                                                                          66⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:4192
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:4252
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA677.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:3628
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:6052
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA742.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:5696
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:5616
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA80E.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:252
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:4388
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8E8.bat
                                                                                                                                                              74⤵
                                                                                                                                                                PID:2876
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:6072
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9E2.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:3404
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:2224
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAAD.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:1376
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:4544
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB59.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                              PID:4868
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:2172
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC24.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                    PID:712
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:5776
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACFF.bat
                                                                                                                                                                                        84⤵
                                                                                                                                                                                          PID:412
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                            85⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:5260
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADEA.bat
                                                                                                                                                                                              86⤵
                                                                                                                                                                                                PID:3720
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:2828
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAED4.bat
                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                      PID:2480
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:2520
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFCE.bat
                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                            PID:4980
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                              91⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:5376
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0B8.bat
                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:5828
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:2020
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1B2.bat
                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:4428
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:4840
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB27D.bat
                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                          PID:5356
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:1344
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB349.bat
                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:5256
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:4224
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB433.bat
                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                    PID:1256
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:1700
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB53D.bat
                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                          PID:5196
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:1548
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB637.bat
                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:4532
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:1704
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB702.bat
                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:5052
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:3288
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7CD.bat
                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:3976
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:2372
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8C7.bat
                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:4244
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:2344
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9B1.bat
                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                PID:1388
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:2340
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA7C.bat
                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:5936
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:5608
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB76.bat
                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                          PID:4176
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:1968
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC41.bat
                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                PID:5744
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:4188
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD0D.bat
                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                      PID:4540
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:3012
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDD8.bat
                                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:2792
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:4888
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEC2.bat
                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                PID:3272
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:1052
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF7E.bat
                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                      PID:4968
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:4728
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC049.bat
                                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:3764
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:5476
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0F5.bat
                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:3212
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:2564
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1CF.bat
                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                    PID:628
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:5452
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2AA.bat
                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:3236
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                            PID:1324
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC375.bat
                                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:4932
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:1228
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC421.bat
                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                    PID:4276
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                                        PID:4612
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4DD.bat
                                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                                            PID:1120
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:620
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5A8.bat
                                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:5788
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5732
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC663.bat
                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:256
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4248
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC70F.bat
                                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3300
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:468
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC819.bat
                                                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:5604
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                      149⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4664
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8C5.bat
                                                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:5700
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2420
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC970.bat
                                                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:4748
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5396
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA3C.bat
                                                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:1884
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        PID:6100
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB07.bat
                                                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:2516
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:2948
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBC2.bat
                                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:4160
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC7E.bat
                                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1056
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD49.bat
                                                                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDF5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE91.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5556
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF3D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5468
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFE9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:908
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD16F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3252
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD20C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3284
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5572
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2C7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5864
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD392.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD42E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD577.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD613.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6AF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD75B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD836.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB53.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC0E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCBA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD75.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEFC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF98.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE054.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE11F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE296.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE361.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE40D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE565.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE601.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6AD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE759.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE824.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE98B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA47.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB12.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBFC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECB8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED64.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE00.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEECB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF032.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF17A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF236.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF37E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF40B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF488.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF553.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF61E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF766.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7E3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF870.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF979.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA16.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAC1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB4E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBCB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC58.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4716
                                                                                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Creates a file in the Startup directory
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                            PID:3812
                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                              PID:4796
                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:4332

                                                                                                                                                                                                          Network

                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                Command and Scripting Interpreter

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1059

                                                                                                                                                                                                                Windows Command Shell

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1059.003

                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                Credentials from Password Stores

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1555

                                                                                                                                                                                                                Credentials from Web Browsers

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1555.003

                                                                                                                                                                                                                Unsecured Credentials

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1552

                                                                                                                                                                                                                Credentials In Files

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1552.001

                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1120

                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                System Location Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1614

                                                                                                                                                                                                                System Language Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1614.001

                                                                                                                                                                                                                System Network Configuration Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1016

                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                Data from Local System

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1005

                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                $$a3399.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3399.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 e60b8c67649041bccf0cd9356d2b3d0f24d2ea43c60e66b89b6b750e8751cbe6
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a354F.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a354F.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 bd8bfa61b9f46053fe73b94f69305082fa6e6fc77977ce467ba87d27e4c1ee50
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a4201.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4201.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 3d6040ae9471cb1d60af00dddd63058a3b8776f5311209713fb2085d6c7fa1f1
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a4944.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4944.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 f12571ad20550197eea9fb9bee8019f5ae53515a7c7c6756e116f701d01adda0
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a5C7E.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5C7E.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 d0696edade684e265a914bb2ffc4831ff1f3a68063286c546bb7cd4a8535d4e6
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a62D7.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a62D7.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 c0e7c72b3ae916b439b5e13150b952769792e79c765bd971bc33c820dc99f979
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a6865.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6865.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 df0c2939726299086ef18945df31fd0955b00536ea9a1cc7e346293b088c89b7
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a6C2D.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6C2D.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 b052394ef113ea0c28fe6d30aea2906a7db62dbdabe76e51cf8bb0199645ddee
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a6F0C.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6F0C.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 4fa48e0ee02f7b7dbaef1775afd9c95094267c94c98520c01d6f5d0fa5d0a336
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a74A9.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a74A9.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 dadc939a911eead48722abc315c7630f584958d341251416ed4f31da4b611875
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a77A7.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a77A7.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 c03f23266708564357aa01c31075e62064fc36455fe52cb2d0713bc6bc556d05
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a7A47.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7A47.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 49165773598b5e48442e3748c17720618cc194ee533025ecbe100de8492966cf
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a7F29.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7F29.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 feffb7e8c651188acc97233ea4c98c07e859538491cf4e322100887e039aa729
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a8708.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8708.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 9df280b6b76713b63c3774774b37da6e178cea8920193c349ba4bd139a7e131f
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a89D7.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a89D7.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 e3cbfc83a649d99e58cf9e8f97499e44280366e00db0eb355cba0aa3373a3ac8
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a8C19.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8C19.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 55ea84b5cd39ac59e90a9ab9b8205dc4f13c2b14c11b2d3a61d34e9b40be1721
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a8F65.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8F65.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 96ba5d4f1391013c48e8ec5872c0bfcc37f4b714d8263c8ac1b43cf932cfd0f3
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a912A.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a912A.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 c94ba0167898c661fb8458e303e8531d14273f737327d6857171e1a3607242b6
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a933D.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a933D.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 4b69cd77ada5638ae3c95060b8e024e78ea67c7b9b0b40c2f7afc0ba3c7a0a48
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a95AE.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a95AE.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 a674da5957f8c941682f9160b30afa10e218da587150a3f851a25c627fb6eaea
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a97F1.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a97F1.bat
                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                • SHA256 fc2c860569d28b2ab0e733f96f06b4fb706dfd420cd0e70cc1ec01711fd342b6
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 5.2MB
                                                                                                                                                                                                                • SHA256 05cdfc29aa70bf7ee718ffb1d3e47ce9818364f1d0fc68b18f04a8efb7d1b95f
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                                                                • SHA256 774b74ef5d5dcd686a98d0a25723b3be1069e5d556cd592609998a7d08ae7488
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                                                                • SHA256 1ac2f549c0f21239164e1b7535cd14b52c98f3b6af693421aa3131aaf8f16070
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                                                                • SHA256 33f0f5ec5b583bcd79cc48a00278614771bbb6412074917eae7176917ae85487
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                                                                • SHA256 f8e3a56229a0bff5d2335f81cd0083eec0188a8fd30e55e6a150da5e9a187e7c
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 4.9MB
                                                                                                                                                                                                                • SHA256 927354968cbfff6a16d790586d5d2709e3b3c7ffc81948817cdcd04439a9ffd2
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 4.8MB
                                                                                                                                                                                                                • SHA256 3e31e5d651c0b28e23693e7cbbea642100a4cca125f87da62f19b8bd12c8f977
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                                                                • SHA256 8b6ae25b1d842dab0bfc843137ca4fe64836e6536893179667eb7a01a1e705d4
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 4.9MB
                                                                                                                                                                                                                • SHA256 7c912e14fd664b9fad10538f43f2c21711296d0912ca0fdcfec22033bb94f152
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 4.8MB
                                                                                                                                                                                                                • SHA256 d842280ddbf547d1f857d1cdd4444419ab28213622cc9ecbcad8f88d2a427756
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 4.7MB
                                                                                                                                                                                                                • SHA256 7d38daf3f272f04b3d982c2328a0807a59bfd4400182a626c092afa002001c60
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 4.9MB
                                                                                                                                                                                                                • SHA256 a36cd86feca886caca8323b017a279a11cddec8a4848c79ddcecaabacf341897
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 4.8MB
                                                                                                                                                                                                                • SHA256 4e4374b20b7d2f10f3105fc7c2f3cb680b9c089b7c8e3c15189d4509ef7b4d61
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 4.7MB
                                                                                                                                                                                                                • SHA256 a63394de8e5224b3769e50cc632e93184eca9ce9d6557a8c6987ffad0bacecf7
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 4.7MB
                                                                                                                                                                                                                • SHA256 c460da00c14067791cdeaa0da5ea3d6086248d91a4ede0df69c4e22638898b98
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 4.6MB
                                                                                                                                                                                                                • SHA256 c477d5bcfb9327207665915b83c1ba9cd31c21c9cd9ccde4d50684dd44d0c957
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 4.6MB
                                                                                                                                                                                                                • SHA256 44cdb16310bdc8f64830d355fee0b5dfe6418b24ae7649006b35d91bb1212f86
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 4.6MB
                                                                                                                                                                                                                • SHA256 49186cfec76e6f45badd8a402fc583c1c0d0c5f2b8dbc057c1d5e35874cb3ca8
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                                                                • SHA256 33f8065f5255ae51cf4077b87d26bcaefb8c15c614ae8140a33b228910eb3226
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\815ea6a73e74bde47c9ae5c58ae77eedd34fa791354ca68824b0603ca11816af.exe.exe
                                                                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                                                                • SHA256 e867c26310c34d8701f395af096f9b0b5451defd2bd1a47ab1b71dad4969edf5
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Logo1_.exe
                                                                                                                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                • Size 32KB
                                                                                                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                _desktop.ini
                                                                                                                                                                                                                • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                                                                                • Size 10B
                                                                                                                                                                                                                • SHA256 3cc655fb77d8ee9d3bd8d6ef6851f203306a7e76fc6c88010f361a7375fe8836
                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                memory/292-8874-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/468-8481-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/500-8210-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/528-8783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/620-8460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/624-8692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/700-8909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/824-8608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/908-8573-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1052-8404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1056-8530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1228-8446-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1324-8439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1344-8319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1460-8853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1504-8148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1544-8952-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1548-8337-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1656-5549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1668-8615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1700-8331-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1704-8343-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1796-8937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1804-8790-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1968-8379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2020-8307-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2064-8769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2100-8987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2108-8130-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2116-8881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2144-5132-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2160-8558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2172-8271-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2220-8839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2224-8259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2320-8167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2340-8367-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2344-8361-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2372-8355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2420-8495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2492-8699-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2520-8295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2564-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2600-8776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2612-8755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2628-8671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2664-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2708-6028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2720-8980-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2724-8102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2736-8741-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2764-8664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2768-4230-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2796-8860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2828-8289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2896-8622-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2932-8111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2948-8516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3012-8391-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3084-8846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3092-8629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3124-8944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3196-8994-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3204-8832-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3264-8082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3288-8349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3360-8895-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3464-8867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3508-8713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3616-9001-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3812-2998-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3812-7168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3812-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3812-8248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3812-1984-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3880-8650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4072-8173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4080-8093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4136-8902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4140-6037-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4188-8385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4224-8325-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4228-8155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4232-8916-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4248-8474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4252-8228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4288-8706-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4320-8191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4332-8685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4336-45-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4360-6659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4388-8246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4464-8973-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4472-8811-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4480-8197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4528-8727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4544-8265-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4604-8825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4612-8453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4628-8523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4652-6050-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4664-8488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4728-8411-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4804-8923-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4820-8580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4840-8313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4864-8199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4864-8139-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4888-8397-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4908-8636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4948-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4948-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4972-8797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5028-8643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5040-8185-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5056-8216-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5148-8537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5216-8544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5228-8222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5236-8204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5260-8283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5264-8601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5328-8930-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5332-197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5360-9008-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5376-8301-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5396-8502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5452-8432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5464-8566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5476-8418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5484-8966-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5516-5558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5544-8594-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5556-8551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5572-8587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5600-8804-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5608-8373-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5616-8240-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5628-8720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5684-8888-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5732-8467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5748-8678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5760-9010-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5760-9016-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5776-8277-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5796-8748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5840-8657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5844-3007-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5860-8121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5880-8161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5884-8762-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5912-8818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5968-8734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/6052-8234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/6060-8959-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/6072-8253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/6100-8509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/6128-8179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download