Overview

overview

7

Static

static

3

313aea77cc...6b.exe

windows10-2004-x64

7

313aea77cc...6b.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    108s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250502-en
  • resource tags

    arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11/05/2026, 10:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
  • Size 2.7MB
  • Sample260511-mamltsas8l
  • SHA256 313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
    "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5840
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4268.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6096
      • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4436
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a440E.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5432
          • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
            "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1908
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4546.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2232
              • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4860
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a468E.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5056
                  • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                    "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4968
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47B7.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:5920
                      • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4616
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a494D.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:2760
                          • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                            "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:4012
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AB5.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4420
                              • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:5584
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C5B.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:936
                                  • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                    "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:1896
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DD2.bat
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:5400
                                      • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:804
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F1A.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:6048
                                          • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                            "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:2828
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50A0.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3760
                                              • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:780
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5227.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3220
                                                  • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3272
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a537F.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5656
                                                      • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1016
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5515.bat
                                                          28⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1928
                                                          • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3484
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a566D.bat
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4596
                                                              • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5208
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57C5.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4028
                                                                  • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4208
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a590D.bat
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4740
                                                                      • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5756
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A93.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3400
                                                                          • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2772
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BFB.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3532
                                                                              • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3204
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D62.bat
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3992
                                                                                  • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4456
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EC9.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:992
                                                                                      • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4252
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6012.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4540
                                                                                          • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5060
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6189.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5932
                                                                                              • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2808
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a638C.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:108
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1884
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6551.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:5368
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4952
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a666B.bat
                                                                                                          52⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2240
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5308
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6707.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3744
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3184
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6793.bat
                                                                                                                  56⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2624
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5204
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a683F.bat
                                                                                                                      58⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2176
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:440
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68EB.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2292
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:2088
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6987.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:444
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:5692
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A43.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:4948
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:1268
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C47.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:2612
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:4412
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70FA.bat
                                                                                                                                              68⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4040
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:544
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7242.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3604
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:6020
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7417.bat
                                                                                                                                                      72⤵
                                                                                                                                                        PID:2036
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:5392
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a757E.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:4840
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              PID:3180
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7705.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:4156
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:5004
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a781E.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                      PID:1040
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:976
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7966.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                            PID:5276
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:1556
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7ADD.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:5188
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:5624
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B98.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                        PID:908
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                          85⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2212
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C54.bat
                                                                                                                                                                                            86⤵
                                                                                                                                                                                              PID:5760
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                87⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:1460
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CF0.bat
                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:3152
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:1732
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D5E.bat
                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                        PID:1676
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:3092
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E19.bat
                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                              PID:1664
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:4556
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EF4.bat
                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                    PID:1064
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:2880
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8165.bat
                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                          PID:4356
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:1820
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82BD.bat
                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                PID:476
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:1728
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8368.bat
                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                      PID:3420
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:852
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83C6.bat
                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                            PID:5216
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:4152
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8424.bat
                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:5956
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:2004
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8482.bat
                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:5496
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:1756
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84FF.bat
                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                          PID:1072
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:2356
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a857C.bat
                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                PID:1564
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:2696
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85D9.bat
                                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:3424
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:5200
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8666.bat
                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                          PID:5420
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:5704
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86C4.bat
                                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                                                PID:6056
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:960
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8722.bat
                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:1372
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:2496
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a877F.bat
                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                          PID:5072
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:2372
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87DD.bat
                                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                                PID:4024
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:3848
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a882B.bat
                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                      PID:4116
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:1484
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88C7.bat
                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:2084
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:5452
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8916.bat
                                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:4816
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:1480
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8983.bat
                                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:5244
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    PID:4760
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89E1.bat
                                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                                        PID:3292
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:1632
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A9C.bat
                                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                                              PID:5696
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:3412
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BD5.bat
                                                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:5156
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                                      PID:3040
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D4C.bat
                                                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                                                          PID:2348
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:448
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E94.bat
                                                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                                                                PID:1400
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:4416
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FEC.bat
                                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6036
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:4980
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9134.bat
                                                                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1240
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                                                                                              145⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              PID:3032
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9470.bat
                                                                                                                                                                                                                                                                                                                                                                146⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:5356
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4612
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95B8.bat
                                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5744
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          PID:1436
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97CB.bat
                                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:6092
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:3508
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98D5.bat
                                                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4936
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
                                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:5896
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9961.bat
                                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                        PID:5764
                                                                      • C:\Windows\Logo1_.exe
                                                                        C:\Windows\Logo1_.exe
                                                                        2⤵
                                                                        • Drops startup file
                                                                        • Executes dropped EXE
                                                                        • Enumerates connected drives
                                                                        • Drops file in Program Files directory
                                                                        • Drops file in Windows directory
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4660
                                                                        • C:\Windows\SysWOW64\net.exe
                                                                          net stop "Kingsoft AntiVirus Service"
                                                                          3⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3872
                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                            4⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1556

                                                                    Network

                                                                          MITRE ATT&CK Enterprise v16

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          $$a4268.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4268.bat
                                                                          • Size 722B
                                                                          • SHA256 f4aca2567d217146c0de4312e5c04d5ebff63f121c110d0f3a38d6ccfe6cd173
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a440E.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a440E.bat
                                                                          • Size 722B
                                                                          • SHA256 b042e4ad78c335feb7b1914f3aad1654ccae1170179ac21c9d9b6bcefa1b97ee
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a4546.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4546.bat
                                                                          • Size 722B
                                                                          • SHA256 9ae0c009c2daba730b0a19fe45ec8c333060f6e503f7c11acd7f69f0e9063fc5
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a468E.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a468E.bat
                                                                          • Size 722B
                                                                          • SHA256 78256c66270ce783b1cdaba8085411347355d18bb567682cef5ccbd2a6e8d7ec
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a47B7.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a47B7.bat
                                                                          • Size 722B
                                                                          • SHA256 caf4575b8236974ebb4b5b8ac8141a577ae4b5101b3f8922405e70c4c68084ae
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a494D.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a494D.bat
                                                                          • Size 722B
                                                                          • SHA256 327dac10f0ae542b825b0cd8139804e2fb37e68aedce5e7e8c24fd3e07f56ac2
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a4AB5.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4AB5.bat
                                                                          • Size 722B
                                                                          • SHA256 13494b2afcd3bd9e765bd9a6d90304d4038d11ee373733171dfd3d677f92d45a
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a4C5B.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4C5B.bat
                                                                          • Size 722B
                                                                          • SHA256 db8fc156fa6871af4947a5322cc1feabbbe5dc5e9b0a02ffb9f22f74b87db54f
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a4DD2.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4DD2.bat
                                                                          • Size 722B
                                                                          • SHA256 44f8a8a32a2db8c6fc27b5ef6e15483ff74f21421690150a1404ab3942dbce87
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a4F1A.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4F1A.bat
                                                                          • Size 722B
                                                                          • SHA256 eece46fca5d8b9a649a826c1faab51d312f0d6d958f6111361f39cfd0fae7b31
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a50A0.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a50A0.bat
                                                                          • Size 722B
                                                                          • SHA256 c09018f00ea13e49896a3dc83bdb22855637fd2a950466f87c46ba9c92c4d2b0
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a5227.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5227.bat
                                                                          • Size 722B
                                                                          • SHA256 8457f106099f87b012591ef17415c988a032f18b0d2c21d12a3e5957051d969b
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a537F.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a537F.bat
                                                                          • Size 722B
                                                                          • SHA256 b52240f394f54b0cec4a94bc608d2e759bc432d0c36ac83fa73eadc208025589
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a5515.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5515.bat
                                                                          • Size 722B
                                                                          • SHA256 5c0c26955d45ffbacb4fe40f5120a97071cce38efba2b6a0b55959dbf3f49134
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a566D.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a566D.bat
                                                                          • Size 722B
                                                                          • SHA256 b59f795d77f26bd0fd40db479d6f610b18d831d2e9de1572db4f89284bff85f8
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a57C5.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a57C5.bat
                                                                          • Size 722B
                                                                          • SHA256 c533e1d9974af6d136498028056bc8e6290651ebf7d161661f186699fa34329f
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a590D.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a590D.bat
                                                                          • Size 722B
                                                                          • SHA256 dcb2e62330b7a34c837a9cc98e6e33b056304105ea430eaf887fe38e45aed5d1
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a5A93.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5A93.bat
                                                                          • Size 722B
                                                                          • SHA256 1df2058172a6b4186245b3b0f00088da450d939179ab9f875ae45da6dd8b8b2c
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a5BFB.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5BFB.bat
                                                                          • Size 722B
                                                                          • SHA256 27c7d0a9e178e40c944a0efc11646de27a44ba252bbd9937ae1c5b06c38b238e
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a5D62.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5D62.bat
                                                                          • Size 722B
                                                                          • SHA256 af369227c7f63fc5fb7c7701a439aabec380e02dba07a2a45c6ca896e493cab0
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a5EC9.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5EC9.bat
                                                                          • Size 722B
                                                                          • SHA256 ac8cd7878e376966e2c066858b7a8c685a7c74485fed017e4367551f96d64812
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                          • Size 2.3MB
                                                                          • SHA256 ec5f5552ac1fb7d2a3b27fa652d5db5bbb4ee41e47c852829cfdb950bd2c32e3
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
                                                                          • Size 2.2MB
                                                                          • SHA256 e4017e4c88099e638efdc0872cce9a965a2e9f9bbdaf1175df11cfba8e08a4c8
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.7MB
                                                                          • SHA256 6945dcfb51069fa582811d7fdb0161113b4e47c56a0bb7b5aca5d98711800896
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.7MB
                                                                          • SHA256 96fb5b26dc729d1b6de92375fce0e940295c9c9d1a2041aa5b2a2f05a4f92144
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.6MB
                                                                          • SHA256 67aebdcd4f8d2ee4d1ef518ba06b1a335b3bfd0a41ea67f2f1e6bf32e2a3ab0a
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.5MB
                                                                          • SHA256 95f3bc086f8db469a045e70810de7e675e8bf60416714bf3a2098a5138607bbe
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.6MB
                                                                          • SHA256 238a4a33ad09f1398bc253309bf07ec4453ea6f379fb256121e5a795560d6edf
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.5MB
                                                                          • SHA256 733e3dd78b3fd28c1537f56361c926ceca4e50ac9def4adfcc4756a4890581e1
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.5MB
                                                                          • SHA256 535b9c06f26130592701e518e0bd2d8713bdfcef8017ccccfda55999998072e5
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.4MB
                                                                          • SHA256 90dca9f86e84805c8423293d6877704fe3a5b41366f9702e95a75b71868be3ad
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.5MB
                                                                          • SHA256 86d1d43c76f7d95ad8bd0634d3a859c98e515756ca709d5d4c3fa6829602afeb
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.4MB
                                                                          • SHA256 83603909912bb0c88f30309d739778ab31831bb772f8c2db3c6e824f21a55bd6
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.4MB
                                                                          • SHA256 ce100db0f170e5b46307a0b6301b1e1427fb5e9afee5bb490a3749538fb3f786
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.3MB
                                                                          • SHA256 f6cf65d945a05ec659b262c8e301fb677cf1b6044f8744f05eab091236598041
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.2MB
                                                                          • SHA256 55c64ee184ec8b28fffa90806312112ded3b5074d4893d317e593bcb9787c896
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.3MB
                                                                          • SHA256 ef167941cceef90201620cb4f234001953f6c3fecd69165108234d381fa8ac4f
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.2MB
                                                                          • SHA256 9c57b26e16ba560898b8ad48e5fc19185f0ffc07642bf894f2ce6d210a2bd404
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.1MB
                                                                          • SHA256 2f70221387020d36280e9f9a0a715adeff5e5c58386d7572cc411087c9338dab
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.1MB
                                                                          • SHA256 7a71c7db5e081b93895f48df9d3dd3cff8f244ceda906bf9d9a524bb574aba13
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe.exe
                                                                          • Size 2.6MB
                                                                          • SHA256 7e4d145627d7069072bc289c7258cb7e90b4e4a9c13dc2da2e5a37edc44385af
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Logo1_.exe
                                                                          • Path C:\Windows\Logo1_.exe
                                                                          • Size 32KB
                                                                          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          _desktop.ini
                                                                          • Path F:\$RECYCLE.BIN\S-1-5-21-330179853-1108322181-418488014-1000\_desktop.ini
                                                                          • Size 9B
                                                                          • SHA256 19944e3d79dbaa55528729df082eccbb0b32b6eb8f9e657c445f9a044a342a86
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          memory/440-1959-0x0000000002010000-0x00000000020CB000-memory.dmp
                                                                          Download

                                                                          memory/440-1958-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/448-8163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/544-3429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/780-117-0x0000000002010000-0x00000000020CB000-memory.dmp
                                                                          Download

                                                                          memory/780-116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/804-95-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/804-96-0x0000000002010000-0x00000000020CB000-memory.dmp
                                                                          Download

                                                                          memory/852-6265-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/960-6317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/976-5284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1016-135-0x00000000021C0000-0x000000000227B000-memory.dmp
                                                                          Download

                                                                          memory/1016-134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1268-2769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1436-10676-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1460-5734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1480-6353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1484-6341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1556-5676-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1632-6569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1728-6259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1732-5740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1756-6283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1820-6253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1884-1802-0x0000000002010000-0x00000000020CB000-memory.dmp
                                                                          Download

                                                                          memory/1884-1797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1896-87-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1896-88-0x0000000002010000-0x00000000020CB000-memory.dmp
                                                                          Download

                                                                          memory/1908-30-0x0000000002170000-0x000000000222B000-memory.dmp
                                                                          Download

                                                                          memory/1908-29-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2004-6277-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2088-1963-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2088-1964-0x0000000002010000-0x00000000020CB000-memory.dmp
                                                                          Download

                                                                          memory/2212-5728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2356-6289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2372-6329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2496-6323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2696-6295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2772-179-0x0000000002170000-0x000000000222B000-memory.dmp
                                                                          Download

                                                                          memory/2772-178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2808-1444-0x0000000002150000-0x000000000220B000-memory.dmp
                                                                          Download

                                                                          memory/2808-1386-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2828-108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2828-109-0x0000000002150000-0x000000000220B000-memory.dmp
                                                                          Download

                                                                          memory/2880-6111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3032-9365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3040-7727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3092-5746-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3180-4771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3184-1948-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3184-1949-0x0000000002010000-0x00000000020CB000-memory.dmp
                                                                          Download

                                                                          memory/3204-187-0x0000000002010000-0x00000000020CB000-memory.dmp
                                                                          Download

                                                                          memory/3204-186-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3272-126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3272-127-0x0000000002060000-0x000000000211B000-memory.dmp
                                                                          Download

                                                                          memory/3412-7153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3484-142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3484-143-0x0000000002170000-0x000000000222B000-memory.dmp
                                                                          Download

                                                                          memory/3508-10768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3848-6335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4012-66-0x0000000002010000-0x00000000020CB000-memory.dmp
                                                                          Download

                                                                          memory/4012-65-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4152-6271-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4208-161-0x0000000002070000-0x000000000212B000-memory.dmp
                                                                          Download

                                                                          memory/4208-160-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4252-339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4252-360-0x0000000002160000-0x000000000221B000-memory.dmp
                                                                          Download

                                                                          memory/4412-3001-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4416-8569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4436-22-0x0000000002050000-0x000000000210B000-memory.dmp
                                                                          Download

                                                                          memory/4436-21-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4456-195-0x0000000002010000-0x00000000020CB000-memory.dmp
                                                                          Download

                                                                          memory/4456-194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4556-5752-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4612-9875-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4616-58-0x0000000002010000-0x00000000020CB000-memory.dmp
                                                                          Download

                                                                          memory/4616-57-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4660-8-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4660-104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4660-1965-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4660-1966-0x0000000002010000-0x00000000020CB000-memory.dmp
                                                                          Download

                                                                          memory/4760-6359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4860-37-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4860-38-0x0000000002030000-0x00000000020EB000-memory.dmp
                                                                          Download

                                                                          memory/4952-1939-0x0000000002030000-0x00000000020EB000-memory.dmp
                                                                          Download

                                                                          memory/4952-1938-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4968-49-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4968-48-0x0000000002070000-0x000000000212B000-memory.dmp
                                                                          Download

                                                                          memory/4980-8941-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5004-5073-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5060-769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5060-780-0x0000000002150000-0x000000000220B000-memory.dmp
                                                                          Download

                                                                          memory/5200-6305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5204-1953-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5204-1954-0x0000000000690000-0x000000000074B000-memory.dmp
                                                                          Download

                                                                          memory/5208-152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5208-153-0x0000000002060000-0x000000000211B000-memory.dmp
                                                                          Download

                                                                          memory/5308-1943-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5308-1944-0x0000000002070000-0x000000000212B000-memory.dmp
                                                                          Download

                                                                          memory/5392-4319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5452-6347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5584-80-0x0000000002090000-0x000000000214B000-memory.dmp
                                                                          Download

                                                                          memory/5584-79-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5624-5722-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5692-2190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5692-2192-0x0000000002030000-0x00000000020EB000-memory.dmp
                                                                          Download

                                                                          memory/5704-6311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5756-169-0x0000000002150000-0x000000000220B000-memory.dmp
                                                                          Download

                                                                          memory/5756-168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5840-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5840-11-0x00000000022A0000-0x000000000235B000-memory.dmp
                                                                          Download

                                                                          memory/5840-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5896-10769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5896-10775-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/6020-3893-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download