Overview

overview

7

Static

static

3

fcb9a88aba...89.exe

windows10-2004-x64

7

fcb9a88aba...89.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    93s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    08/05/2026, 10:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
  • Size 2.9MB
  • Sample260508-mkec7sfy21
  • SHA256 fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
    "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14FA.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:436
      • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
        "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3184
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1623.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3372
          • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
            "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:5092
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a172D.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4332
              • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:664
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17D8.bat
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2236
                  • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                    "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3960
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18A4.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3868
                      • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                        "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:1276
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a198E.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1072
                          • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                            "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:1752
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A69.bat
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:2884
                              • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:1440
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B24.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4808
                                  • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                    "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:4904
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C0F.bat
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:5072
                                      • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                        "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:1144
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CCA.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2400
                                          • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                            "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:2496
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D76.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:3628
                                              • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:2424
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E22.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3532
                                                  • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4248
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EDD.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3196
                                                      • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2676
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F89.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1884
                                                          • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:716
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2054.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3104
                                                              • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4356
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2110.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4412
                                                                  • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2368
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21AC.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3404
                                                                      • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2124
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22C5.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1428
                                                                          • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3316
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2371.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4124
                                                                              • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4444
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a244C.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2196
                                                                                  • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:940
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24E8.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1808
                                                                                      • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2964
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25A4.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3536
                                                                                          • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1972
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25F2.bat
                                                                                              46⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4632
                                                                                              • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1788
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2650.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2636
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3928
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26AD.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1524
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1792
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a270B.bat
                                                                                                          52⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:732
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2380
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2759.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3092
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2120
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27D6.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1320
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1372
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2863.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2620
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:2452
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28D0.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:3612
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:2080
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a294D.bat
                                                                                                                              62⤵
                                                                                                                                PID:3932
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:4276
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29DA.bat
                                                                                                                                    64⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:1092
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:1060
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2AD4.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:948
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:4968
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C89.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:388
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4884
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D83.bat
                                                                                                                                                    70⤵
                                                                                                                                                      PID:3320
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                        71⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:1184
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E3F.bat
                                                                                                                                                          72⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:1924
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:3968
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E9D.bat
                                                                                                                                                              74⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:1636
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:4460
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EEB.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:1784
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:4972
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F29.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                        PID:4596
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:2412
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F97.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:1608
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:1460
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3023.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:3552
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:236
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30B0.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                        PID:2132
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                          85⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:4376
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a311D.bat
                                                                                                                                                                                            86⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:2948
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:1760
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a318B.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:1520
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:2640
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31D9.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                      PID:3732
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:2556
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3246.bat
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                            PID:4056
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4892
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3340.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:3652
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:4800
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35D0.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                      PID:4080
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:2952
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36BB.bat
                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:4688
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:4492
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3795.bat
                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                PID:2444
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:4916
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38BE.bat
                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                      PID:916
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:3688
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a397A.bat
                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                            PID:1628
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:1012
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A35.bat
                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:1756
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:4700
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B00.bat
                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                      PID:4708
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:4128
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BCC.bat
                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                            PID:1296
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:1348
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C87.bat
                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:5004
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:4392
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D33.bat
                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:3692
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:2628
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E6B.bat
                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                          PID:620
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:352
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FC3.bat
                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:2600
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:2592
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4021.bat
                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                    PID:1900
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:1264
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a405F.bat
                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                          PID:444
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:240
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40CD.bat
                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                PID:3836
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:3192
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a411B.bat
                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:1324
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:3332
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4159.bat
                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:564
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                            PID:424
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41B7.bat
                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                                PID:1468
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:1624
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4205.bat
                                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:1424
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:1948
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4292.bat
                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:4536
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:4676
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42F0.bat
                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:2632
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:2372
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a433E.bat
                                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:1896
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:2612
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a438C.bat
                                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                                      PID:412
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                                                        141⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:4856
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4476.bat
                                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:912
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:1040
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44F3.bat
                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:4484
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5076
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4541.bat
                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:3796
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      PID:4760
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4580.bat
                                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                                          PID:460
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:4560
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45ED.bat
                                                                                                                                                                                                                                                                                                                                                              150⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2384
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:756
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a465B.bat
                                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:4232
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:2800
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46B8.bat
                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3944
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2932
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46F7.bat
                                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5060
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1544
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4774.bat
                                                                                                                                                                                                                                                                                                                                                                                        158⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3564
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe"
                                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4108
                                                                  • C:\Windows\Logo1_.exe
                                                                    C:\Windows\Logo1_.exe
                                                                    2⤵
                                                                    • Drops startup file
                                                                    • Executes dropped EXE
                                                                    • Enumerates connected drives
                                                                    • Drops file in Program Files directory
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4952
                                                                    • C:\Windows\SysWOW64\net.exe
                                                                      net stop "Kingsoft AntiVirus Service"
                                                                      3⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4660
                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                        4⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:4488

                                                                Network

                                                                      MITRE ATT&CK Enterprise v16

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      $$a14FA.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a14FA.bat
                                                                      • Size 722B
                                                                      • SHA256 a279dfd454ca9ec8a50e86b05f70895770078b33da2f69a7f31797a2decfce17
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a1623.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1623.bat
                                                                      • Size 722B
                                                                      • SHA256 aeaca4e95f0616caf8477803b606a117accdc544c38108bfb75296856ef42110
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a172D.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a172D.bat
                                                                      • Size 722B
                                                                      • SHA256 b9362ba7a3d4cafc5dffbb72ce1a8ddfb63215ceb93f624ee7640f113bb9a73e
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a17D8.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a17D8.bat
                                                                      • Size 722B
                                                                      • SHA256 7cba91c00dc1c67806355f6179cef14fe2ed5062886f019fdd6f21379834920d
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a18A4.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a18A4.bat
                                                                      • Size 722B
                                                                      • SHA256 c51308f87c9c62bec9112cda2620ee31e1aa3f86cee82ec0901d11dacf3868ec
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a198E.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a198E.bat
                                                                      • Size 722B
                                                                      • SHA256 265ba396d465d30899a276dcab5e0ddaec40faa446f8e95bf7079e8f095e4493
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a1A69.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1A69.bat
                                                                      • Size 722B
                                                                      • SHA256 226dfafdcd4ded9c43d5bfae27568ad6d132caa0ae2d30126bc26538763e27d9
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a1B24.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1B24.bat
                                                                      • Size 722B
                                                                      • SHA256 9d408809788598db6fa13d09145112dff895e93b78aee8484e60f4e024f7d2ae
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a1C0F.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1C0F.bat
                                                                      • Size 722B
                                                                      • SHA256 2195333bc2c3752954b20174b74273318fcd1a00c586e1336937623bc45fcb3a
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a1CCA.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1CCA.bat
                                                                      • Size 722B
                                                                      • SHA256 e854e5a2d47ec65333a7bc020740bcba5b5bd9eee42303053064a7beb6ec7f04
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a1D76.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1D76.bat
                                                                      • Size 722B
                                                                      • SHA256 ab5778b8834a4f26f050bf13ee61a214f7dcea28457ef7ce2dcd9d66fa534e65
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a1E22.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1E22.bat
                                                                      • Size 722B
                                                                      • SHA256 6759c0c67a6ee14b0aad58c9a9a413c228b4315398afe90f4c7c62f319a7a6c8
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a1EDD.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1EDD.bat
                                                                      • Size 722B
                                                                      • SHA256 30d040f4068e7a23889b4d4de4c604b65526ddebabd39d66482377bb45a03837
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a1F89.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1F89.bat
                                                                      • Size 722B
                                                                      • SHA256 d452a7ffec7930e5a4e297b6dea24c6f355df6bb08606bb29fd69290463cde03
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a2054.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a2054.bat
                                                                      • Size 722B
                                                                      • SHA256 a7bbcb3e77fc5137c1548c604136a3e80291e87a05c3b1f9cb018cd250033e43
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a2110.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a2110.bat
                                                                      • Size 722B
                                                                      • SHA256 b5c0c4f1a27dcf3cc63d95da1fd805bb65af6b8028154e860f4cce4b22b9bc61
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a21AC.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a21AC.bat
                                                                      • Size 722B
                                                                      • SHA256 32e772a3a6d923a73af0581ec46a540f407879e260151a11d4a13d506a059a53
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a22C5.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a22C5.bat
                                                                      • Size 722B
                                                                      • SHA256 c14f443280d037c955e3789ff2cb093601025958380b773ac3245b59f8c16e8c
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a2371.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a2371.bat
                                                                      • Size 722B
                                                                      • SHA256 553748f040c59cfba29c18df9d28c6cd713d5a490c63759bc4a9c28bd9401889
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a244C.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a244C.bat
                                                                      • Size 722B
                                                                      • SHA256 02bc0eda75f5e3eb9df19f5bff3ce2d566c7a30000e11fa1c08be30520f3a518
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a24E8.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a24E8.bat
                                                                      • Size 722B
                                                                      • SHA256 1654b41e8ee51a1c13813ac1c6a4ee50478a40f69689d8729eaaf892cf0f9801
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.6MB
                                                                      • SHA256 91329c4a43572434a61c24d82c5ac8e83b9aeb3b6d53bc9277e706610621b6a3
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.9MB
                                                                      • SHA256 66fa76038db8c0e27ac61cc000fbf260ecd6fcb8ebd75dc8257bf6933042e5e7
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.6MB
                                                                      • SHA256 dac32216b1fd7abd4018cfedd325aa279d5cdb58631f2b1f5582c19ebc51b96d
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.8MB
                                                                      • SHA256 990b7633a6df8611e6e43af0cdd43b054677bb8d25cc3f7128222f0b60a0fa6f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.5MB
                                                                      • SHA256 b3a267d1e0ddd2d685a51631dc39e7d0e7e337e5f511db188914cdc6c47fb563
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.7MB
                                                                      • SHA256 e02dee97807d79fabb42bbb8f1bce450fdc6ba51e70537d45bc400ecf44d6c82
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.5MB
                                                                      • SHA256 a15b693981b4841b79165c036df4370d2db85dfeaa913d22971d9e2189c9030b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.7MB
                                                                      • SHA256 2b4c852c63d5779cafc7bd6742e9d5f87612d4e857a87fd5f63d516e7b44004a
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.4MB
                                                                      • SHA256 76406040f5b97fa4505a6e3f7de7371476f0bab4613e855d503e2129386e301d
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.9MB
                                                                      • SHA256 82eee1e0aefa9d19248c7d5a357723251a8068edb8494bd0e6f7b1f17dde3978
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.6MB
                                                                      • SHA256 3dbc1504a889852219d794ce0a245399b1d0f6e87f5ca963cad4e2aba56230ce
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.3MB
                                                                      • SHA256 15786d9b44ed9ea67293ae27a85d2c8c683c19cb44a5a090e862e41d4c41a499
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.8MB
                                                                      • SHA256 607da3f2bcd45506c843f1174574f2d234cd9730fa6c6d4fee734019ccf4626b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.5MB
                                                                      • SHA256 ec2ef7e95499f4ef8b7a1aac837b6de9bea3f3d602327432a6a379c293808686
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.8MB
                                                                      • SHA256 5fde046cb850d753385a5372f3c7b0c53450c253fa82220662100ebdc2b72220
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.5MB
                                                                      • SHA256 9647bb857cf94af12b63d3b124bfcad3a7499b964ad29e76e723219f15a7dc99
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.7MB
                                                                      • SHA256 932f0b4a42b2b97a4458e6758794e4f10842564a79c51dea95b95a56fca4a6f0
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.4MB
                                                                      • SHA256 943f2e009a028712d09027df785bb7c3a4f8d9ee290650e14a79eaac34bfaab5
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.4MB
                                                                      • SHA256 f296560a5ebf2093613fd7a2396bd625afdc9bcc3cf072e2c87aceae48273228
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fcb9a88abae550b73f449b3a83d725af0d7f0e5b2843371fa35a89b458809589.exe.exe
                                                                      • Size 2.3MB
                                                                      • SHA256 249f6f2e6b69acda5b819888e9e0fccd1677481ce477036ece8450f9fe46c6ed
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Logo1_.exe
                                                                      • Path C:\Windows\Logo1_.exe
                                                                      • Size 32KB
                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _desktop.ini
                                                                      • Path F:\$RECYCLE.BIN\S-1-5-21-3847269522-1618051987-1942096715-1000\_desktop.ini
                                                                      • Size 8B
                                                                      • SHA256 e56fb91641ab7469399888efdbf398d62f11726a428f5a55482efc687f18f046
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      memory/236-1976-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/240-5746-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/352-5734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/424-5758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/664-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/716-121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/756-6298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/940-169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1012-4146-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1040-6278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1060-529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1144-79-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1184-1952-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1264-5742-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1276-50-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1276-125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1348-4952-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1372-204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1440-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1460-1972-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1544-6314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1544-6309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1624-5763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1752-57-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1760-1984-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1788-184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1792-192-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1948-5768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1972-180-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2080-212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2120-200-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2124-148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2368-141-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2372-5778-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2380-196-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2388-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2388-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2412-1968-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2424-100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2452-208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2496-93-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2556-2074-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2592-5738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2612-5854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2628-5578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2640-1988-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2676-114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2800-6303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2932-6308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2952-2964-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2964-176-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3184-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3192-5750-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3316-155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3332-5754-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3688-3920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3928-188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3960-41-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3968-1956-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4128-4764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4248-107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4276-284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4356-130-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4376-1980-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4392-5217-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4444-162-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4460-1960-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4492-3270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4560-6293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4676-5773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4700-4412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4760-6288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4800-2653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4856-6209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4884-1796-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4892-2414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4904-72-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4916-3699-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4952-4889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4952-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4952-89-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4968-1430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4972-1964-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/5076-6283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/5092-27-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download