Overview

overview

7

Static

static

3

5a6e0e4a48...d7.exe

windows10-2004-x64

7

5a6e0e4a48...d7.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    93s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    24/04/2026, 16:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
  • Size 4.2MB
  • Sample260424-vdbyhaex7w
  • SHA256 5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22A6.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
        "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2828
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a246B.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3724
          • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
            "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2820
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2621.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4904
              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4676
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2815.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1080
                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4700
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A57.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3048
                      • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                        "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3176
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C4B.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:2304
                          • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                            "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:404
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E4E.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3624
                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:4772
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3091.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4996
                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:3832
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3265.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1248
                                      • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                        "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:2432
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3488.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2396
                                          • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                            "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:5112
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37E4.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:3116
                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:4656
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39A9.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2704
                                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4696
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C39.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1432
                                                      • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4664
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F46.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5084
                                                          • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3096
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4179.bat
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4796
                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4476
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a435D.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1532
                                                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4968
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4551.bat
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3452
                                                                      • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1820
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4716.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4636
                                                                          • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1624
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48EB.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4652
                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4276
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B1D.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4464
                                                                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2236
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D11.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1708
                                                                                      • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3376
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F54.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1608
                                                                                          • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1288
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FB1.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4812
                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4880
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a503E.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2096
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1848
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50CB.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3944
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1440
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5128.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3668
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2364
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5196.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1972
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3068
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5222.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3124
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4864
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5280.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2204
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2476
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a531C.bat
                                                                                                                          60⤵
                                                                                                                            PID:3728
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1548
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53B9.bat
                                                                                                                                62⤵
                                                                                                                                  PID:3196
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:2544
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5426.bat
                                                                                                                                      64⤵
                                                                                                                                        PID:3384
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                          65⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:1612
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5484.bat
                                                                                                                                            66⤵
                                                                                                                                              PID:4928
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                67⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:2760
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5501.bat
                                                                                                                                                  68⤵
                                                                                                                                                    PID:3664
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                      69⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:4952
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55AD.bat
                                                                                                                                                        70⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:2844
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                          71⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:4144
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55FB.bat
                                                                                                                                                            72⤵
                                                                                                                                                              PID:3396
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                73⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:4112
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5668.bat
                                                                                                                                                                  74⤵
                                                                                                                                                                    PID:4268
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                      75⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:3204
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5704.bat
                                                                                                                                                                        76⤵
                                                                                                                                                                          PID:808
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                            77⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:4792
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5762.bat
                                                                                                                                                                              78⤵
                                                                                                                                                                                PID:3076
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                  79⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:3064
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57DF.bat
                                                                                                                                                                                    80⤵
                                                                                                                                                                                      PID:2600
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                        81⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:1336
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a586C.bat
                                                                                                                                                                                          82⤵
                                                                                                                                                                                            PID:1056
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                              83⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:4316
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58BA.bat
                                                                                                                                                                                                84⤵
                                                                                                                                                                                                  PID:2532
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:1668
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5918.bat
                                                                                                                                                                                                      86⤵
                                                                                                                                                                                                        PID:1160
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:1132
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5966.bat
                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                              PID:1032
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:1920
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59D3.bat
                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:2112
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:4312
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A31.bat
                                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                                        PID:3788
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:3148
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5ACD.bat
                                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                                              PID:4400
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:1868
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B4A.bat
                                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:3928
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:4508
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BA8.bat
                                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:4504
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:1188
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C06.bat
                                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:1060
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:2240
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C73.bat
                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:4832
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:596
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CF0.bat
                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:3528
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:2756
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D3E.bat
                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                        PID:4392
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:384
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D8C.bat
                                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:1924
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:2020
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DDA.bat
                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                  PID:4228
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:1300
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E67.bat
                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                        PID:2244
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:988
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EF4.bat
                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                              PID:3540
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:3136
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F42.bat
                                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                                    PID:4372
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:5024
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FCE.bat
                                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:1476
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:1716
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a600D.bat
                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                              PID:2720
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                PID:4592
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a605B.bat
                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                    PID:1048
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:2128
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60D8.bat
                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                          PID:1560
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:4060
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6136.bat
                                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                                PID:2408
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                                    PID:3580
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6184.bat
                                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                                        PID:4740
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                                            PID:5116
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61E2.bat
                                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:4348
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:4128
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6230.bat
                                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:3740
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:2848
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62BC.bat
                                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                                        PID:2556
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:2784
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6339.bat
                                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                                              PID:2100
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:2988
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6387.bat
                                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                                    PID:764
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      PID:3884
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6433.bat
                                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2080
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:5044
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64A1.bat
                                                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1656
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2940
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a655C.bat
                                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1688
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3524
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65D9.bat
                                                                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:860
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4836
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6675.bat
                                                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3948
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:5092
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66D3.bat
                                                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2464
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6741.bat
                                                                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3372
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67BE.bat
                                                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:460
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a685A.bat
                                                                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4052
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68C7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6944.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:892
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4488
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6992.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:416
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2460
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6ABB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1344
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B09.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2908
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B48.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1636
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BF4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C80.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D4B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DB9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E36.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EA3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F3F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F9D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7039.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7097.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70F5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7162.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a720E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a726C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7327.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7450.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74BE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a755A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7673.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a770F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a779C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7829.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7980.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BA3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CFB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5000
                                                                                                                                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                  PID:3960
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                    43⤵
                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                    PID:1264
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:4612
                                                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                  PID:3576
                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                    PID:3596
                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:1060
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 996
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:2024
                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3576 -ip 3576
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:4016

                                                                                                                                                                                  Network

                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                        Downloads

                                                                                                                                                                                        $$a22A6.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a22A6.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 976e21538a11d57a1ec932d97bf54b2fab85a4d33c159b4dea6038f05beffbd2
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a246B.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a246B.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 e2b54a93e8c43700f7974db8377d48f502946709bec7fb0f42586e6239503e8c
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a2621.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2621.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 c938216cb2cde16b5623381fee06eadd5b0808cfb988b8d8bd2827a63ad5728c
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a2815.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2815.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 529684726432201e5a8dd92a4abaafab4f9d4053a7a39dde14154d7b9e3e4577
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a2A57.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2A57.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 8dae2e498ca6b2dc4bdb0cb30b3b1cc286481e16ddd26c00328b638233afd082
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a2C4B.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2C4B.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 4ba3fb492c15197a4a7b76020fabbf01b5aa778865fb228fd97b2534c26ba6e3
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a2E4E.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2E4E.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 9290199a774567051b3ecc020f1077ded72008d4df3a45af0b25ca4900d288ce
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a3091.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3091.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 379b20df8777dcf9879df3a9cb1e8ef3bfc84ca90db00da9963489caaf33d616
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a3265.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3265.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 c123d28fd0982cbdbb2fcf7aa11a9087b297d5b853664f09d75fef37635566e7
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a3488.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3488.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 070fa5762444ce7c2e10ebe376c80bf0cf4154ff70ca2cb405f18e0f96b243b5
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a37E4.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a37E4.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 1d2c440c1fe0c2aa4ec5bb684d8941b8a29e4d56fd56e15b9678f9ecb383f843
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a39A9.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a39A9.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 2b6a0a9ede8a651026eb18edeadf52e272ef24d9579f384b7f65fdd94c8262cc
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a3C39.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3C39.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 59e966771644e3675e3497fc94104e89f1f685d7639c5c99f015677824d29b10
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a3F46.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3F46.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 8c4d1e7fe1c91d790c6ae318de3930959328e79645bca4c37af14e8a5250d455
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a4179.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a4179.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 1b0412442400425efdb066aeb9ddfc513b9a567081f4a2a1b231473e3465e357
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a435D.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a435D.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 ade518aeabf881570f6c5b53778982a8861543eaa03a8353c4a6de061be010b5
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a4551.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a4551.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 8f73cffdbba1d55dbeca0d6e6b9515c7678ef7931e091e67919f0718b14e3608
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a4716.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a4716.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 3a7c09e399c7f2d4e74054da38bfbb023de5a3b085f9d126b0387dd56590dc24
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a48EB.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a48EB.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 5f2ba7e74fe7ea15c8605657f793d1dc21b5ca16b5fb07cb5ea3e8beceaa228f
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        $$a4B1D.bat
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a4B1D.bat
                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                        • SHA256 086c9dc7532c1a92e2218275372d1ae872703007cbff0722e80a79f698752eaa
                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 3.7MB
                                                                                                                                                                                        • SHA256 060b3fc09a8571857fb2222d64961a40dcde2b24ed80e011dddafc6a8b6e9c4a
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 3.5MB
                                                                                                                                                                                        • SHA256 c8489312b99946d4f7159f16ef2accf74a908a14b6198671fee89bb1237e760b
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 3.8MB
                                                                                                                                                                                        • SHA256 a97dbc69c525578c2172898b2b0c9048cf02a6a3380e419f3ff2d5f8af51cb23
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 3.8MB
                                                                                                                                                                                        • SHA256 03d904d15dea71edaab4296a7014c0795be9a9a4711e5f1de619d6361c9d539b
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 3.7MB
                                                                                                                                                                                        • SHA256 e79ffe94985dc43f861240e4a3dc7a0c2facf27f08870bfc31ff35b38c7b748f
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 3.6MB
                                                                                                                                                                                        • SHA256 bceef759a7da7c0f519d3808e584d21f917e8e1b6ed61f9bcdf7659b751f0004
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 3.7MB
                                                                                                                                                                                        • SHA256 db69cdea19e0398e9210d6c5bc4e553344cd4bfbed437d13d5cdce4e78a0f580
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 3.6MB
                                                                                                                                                                                        • SHA256 ad65cb5152f343bbdd261c4623587ce3ab08ff889485c40251782ac615315010
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 3.6MB
                                                                                                                                                                                        • SHA256 8e3a56336766f46a4a132e69b95988146df5cbef571b303d3b22cf103ab7d87c
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 4.1MB
                                                                                                                                                                                        • SHA256 27f623e513ccc42596713a15a120e648d65ee02a07d09f942c361adca2ec7cec
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 4.1MB
                                                                                                                                                                                        • SHA256 634127998dfac7b8b731e953a625a46ebc2e1ad2b217aaf0694abfd7c5023c2a
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 4.0MB
                                                                                                                                                                                        • SHA256 74f3e6dec8801280b36fd24b79f24517a241e88babc0faedcf1e5da92f08789a
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 3.9MB
                                                                                                                                                                                        • SHA256 8037a2157f3b2e1f26dbbd4f9fcc17c71b106ba3e0c049b706c438c1cd3a306f
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 3.9MB
                                                                                                                                                                                        • SHA256 993fb0e67f4bf517d685d1961a5f72ec6fcb34c7f84c972b54a6eef5d6865cf3
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 4.2MB
                                                                                                                                                                                        • SHA256 bc576f7dea4f1b5287557aece11683adf57779d08eeaaa23e0a6323986567d46
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 4.1MB
                                                                                                                                                                                        • SHA256 ad67b9f24827735246caf1f6a986ddc6edd63d962237150fe23ac5ae3e1c0c0c
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 4.0MB
                                                                                                                                                                                        • SHA256 98ba5e02003be28d0189354ff46179732299266b4c4db1cd21168689e5293779
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 4.0MB
                                                                                                                                                                                        • SHA256 d1bdb2a1215e918e65ce95ed50f6b678b51944cb4df916073c015bc7b7ca6355
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 3.9MB
                                                                                                                                                                                        • SHA256 b1be69878f85e9f15787d1196f7568f2a54bd50756c8802893cc0db3f747f7c0
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\5a6e0e4a4890a484ce0e0d4ea55e5aa9f9da830dc5c05b95529992fec2d80cd7.exe.exe
                                                                                                                                                                                        • Size 3.8MB
                                                                                                                                                                                        • SHA256 fb47986905b287e6ceed7e6a4fe1edcee36d9822057c7cc67bd911dbf0762f47
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        Logo1_.exe
                                                                                                                                                                                        • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                        • Size 32KB
                                                                                                                                                                                        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        _desktop.ini
                                                                                                                                                                                        • Path F:\$RECYCLE.BIN\S-1-5-21-2122505878-652277452-2375749442-1000\_desktop.ini
                                                                                                                                                                                        • Size 9B
                                                                                                                                                                                        • SHA256 cf938a4f3b0b887724302ddf4689d13c4979f5470df615074767908c6ef30aa0
                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        memory/244-1882-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/384-1701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/404-63-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/416-1832-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/564-1887-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/596-1693-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/652-1974-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/988-1713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1076-1949-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1088-1897-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1132-1660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1188-1685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1204-1964-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1288-1574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1300-1709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1336-1648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1344-1842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1440-1586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1500-1912-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1548-1608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1612-1616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1624-1542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1632-2015-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1632-2010-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1636-1852-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1668-1656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1716-1725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1820-1535-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1848-1582-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1868-1677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/1920-1664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2020-1705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2028-1922-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2128-1733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2176-1989-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2236-1566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2240-1689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2364-1590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2428-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2432-90-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2476-1602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2492-1902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2512-1984-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2544-1612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2628-2009-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2756-1697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2760-1620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2784-1762-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2820-26-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2828-19-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2848-1757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2868-1872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2940-1782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/2988-1767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3036-1932-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3040-1917-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3064-1644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3068-1594-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3088-2004-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3096-1511-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3108-1837-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3136-1717-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3148-1672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3176-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3192-1927-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3204-1636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3316-1959-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3372-1807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3376-1570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3392-1937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3424-1817-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3524-1787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3576-1546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3576-94-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3576-1554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3576-1547-0x0000000003A00000-0x0000000003AC1000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3576-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3580-1742-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3716-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3716-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3732-1994-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3832-81-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3840-1907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3860-1969-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3872-1954-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3884-1772-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3960-1564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/3960-1604-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4048-1867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4060-1737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4112-1632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4128-1752-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4144-1628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4276-1551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4280-1847-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4312-1668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4316-1652-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4332-1862-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4448-1812-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4476-1521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4484-1999-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4488-1827-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4492-1892-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4500-1979-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4508-1681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4592-1729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4656-414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4664-1317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4676-35-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4692-1822-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4696-961-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4700-43-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4772-74-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4792-1640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4836-1792-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4864-1598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4880-1578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4952-1624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/4968-1528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/5024-1721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/5044-1777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/5056-1944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/5068-1802-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/5072-1877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/5092-1797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/5112-98-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download

                                                                                                                                                                                        memory/5116-1747-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                        Download