Overview

overview

7

Static

static

3

88599b2e17...51.exe

windows10-2004-x64

7

88599b2e17...51.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/08/2026, 17:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
  • Size 3.8MB
  • Sample260807-v76d7sttht
  • SHA256 88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
    "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4728
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a914E.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4892
      • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
        "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3956
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94D8.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3284
          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2376
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9630.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2052
              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3040
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98B1.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1140
                  • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                    "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3376
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AA5.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5032
                      • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                        "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:636
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D64.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:3236
                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:2384
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FE5.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:444
                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:4940
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1AA.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4340
                                  • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                    "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:3724
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3AD.bat
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:1428
                                      • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                        "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:2848
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA61E.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:2268
                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:3160
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA851.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:3928
                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:2784
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB4E.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3372
                                                  • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3044
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB050.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2840
                                                      • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3036
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB205.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:768
                                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1940
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB503.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1280
                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5084
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8CC.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1936
                                                                  • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4532
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAC0.bat
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1304
                                                                      • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1892
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCF2.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2008
                                                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4180
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC06D.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1844
                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3516
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC33B.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4248
                                                                                  • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3976
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC723.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3540
                                                                                      • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4664
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC88B.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:860
                                                                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3624
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC927.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1308
                                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:204
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA02.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:872
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2548
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAAE.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4840
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3676
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB5A.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4704
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1196
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC05.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1668
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2436
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC82.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2844
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3788
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD2E.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2248
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:1612
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDCB.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:4480
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:1720
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEA5.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:2488
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:4036
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFAF.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:4484
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:5012
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD03C.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:3804
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:4448
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD126.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:380
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:3840
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD201.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3600
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:4328
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD28D.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4768
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:1312
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD32A.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:3140
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:2624
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3C6.bat
                                                                                                                                                              76⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:4560
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:1180
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD481.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:3728
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:4308
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4FE.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:3520
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:4316
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5D9.bat
                                                                                                                                                                          82⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:1676
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                            83⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:4964
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD666.bat
                                                                                                                                                                              84⤵
                                                                                                                                                                                PID:60
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:2224
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD731.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                      PID:4060
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                        87⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:2944
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7EC.bat
                                                                                                                                                                                          88⤵
                                                                                                                                                                                            PID:4324
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:2212
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD889.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:5096
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:2628
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD915.bat
                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:2664
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:116
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9E0.bat
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                          PID:2688
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:2680
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA9C.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4388
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:5112
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB19.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                    PID:1744
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:1672
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBA5.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:696
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:3952
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC42.bat
                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:1916
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:4800
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCCE.bat
                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                  PID:2388
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:2760
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD4B.bat
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:4832
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:3844
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDE8.bat
                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:3360
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:1288
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE84.bat
                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                PID:4804
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:3984
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF20.bat
                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:1592
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:4220
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFDC.bat
                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                          PID:1460
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:4024
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE068.bat
                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:3780
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:2596
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE143.bat
                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                    PID:5080
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:3316
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1C0.bat
                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                          PID:4268
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:4640
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE24D.bat
                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:1988
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:4992
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE318.bat
                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                    PID:2372
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:596
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3E3.bat
                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                          PID:2988
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:4312
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE48F.bat
                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:1008
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:3912
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE569.bat
                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:3988
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:3888
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE644.bat
                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:2404
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:3260
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6C1.bat
                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:5100
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:4012
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7CB.bat
                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:4196
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:4004
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE867.bat
                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                    PID:5016
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:4820
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE923.bat
                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                          PID:4184
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:2748
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9BF.bat
                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:436
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                143⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:4320
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA5B.bat
                                                                                                                                                                                                                                                                                                                                  144⤵
                                                                                                                                                                                                                                                                                                                                    PID:4200
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:4476
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB17.bat
                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:4516
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:2772
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBB3.bat
                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:1536
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                                                PID:1540
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC6E.bat
                                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:2044
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1972
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED59.bat
                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:3784
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                          153⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          PID:4156
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE72.bat
                                                                                                                                                                                                                                                                                                                                                            154⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4488
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:1712
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEEF.bat
                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:5008
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:4592
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFAA.bat
                                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:3496
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:1864
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF066.bat
                                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:1968
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:1404
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF112.bat
                                                                                                                                                                                                                                                                                                                                                                              162⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:2612
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:344
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1CD.bat
                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:3544
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:1880
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF279.bat
                                                                                                                                                                                                                                                                                                                                                                                      166⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:556
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                          167⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1948
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF354.bat
                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:3884
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3E1.bat
                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      171⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:976
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4AC.bat
                                                                                                                                                                                                                                                                                                                                                                                                        172⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          173⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF567.bat
                                                                                                                                                                                                                                                                                                                                                                                                            174⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5E4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF74C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF807.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8B3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:648
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF95F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA2A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1872
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB14.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1224
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBFF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD18.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3740
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDD3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3688
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1960
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE60.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF4A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFE7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a100.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a352.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4548
                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                      42⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      PID:2876
                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                        43⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                        PID:388
                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                          44⤵
                                                                                                                                                            PID:648
                                                                      • C:\Windows\Logo1_.exe
                                                                        C:\Windows\Logo1_.exe
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Enumerates connected drives
                                                                        • Drops file in Program Files directory
                                                                        • Drops file in Windows directory
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1408
                                                                        • C:\Windows\SysWOW64\net.exe
                                                                          net stop "Kingsoft AntiVirus Service"
                                                                          3⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3800
                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                            4⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3984
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 992
                                                                          3⤵
                                                                          • Program crash
                                                                          PID:3944
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1408 -ip 1408
                                                                      1⤵
                                                                        PID:3808

                                                                      Network

                                                                            MITRE ATT&CK Enterprise v16

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            $$a914E.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a914E.bat
                                                                            • Size 722B
                                                                            • SHA256 71243dfd505c431580cdc1078b000373780f54b5c5caad67838f4571cd4b15ed
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$a94D8.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a94D8.bat
                                                                            • Size 722B
                                                                            • SHA256 bb28bddc257fde25c5f6b66117942f5e23ca057b17768f497b5043015d00df69
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$a9630.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9630.bat
                                                                            • Size 722B
                                                                            • SHA256 d376bfcc72310c779296651d4cd5a8a28763c366a973f72304c1f4b27885ceab
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$a98B1.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a98B1.bat
                                                                            • Size 722B
                                                                            • SHA256 11e38b5106144921ccdd05f2e9ca608b8e0975963dce2075e4bd79966d2059d8
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$a9AA5.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9AA5.bat
                                                                            • Size 722B
                                                                            • SHA256 76004dcae19b915366cd91ba2aa58f787890be0ea0653e268d129a18c1a620ff
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$a9D64.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9D64.bat
                                                                            • Size 722B
                                                                            • SHA256 b159bada8a5eb9db2e6ef40a94838c903d557f2759714f5fba6febe544d2984c
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$a9FE5.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9FE5.bat
                                                                            • Size 722B
                                                                            • SHA256 2231deda50f76b6f88cf32b5d27bfe2c981b8bd7973a82c4679fa4d28750e767
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$aA1AA.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA1AA.bat
                                                                            • Size 722B
                                                                            • SHA256 8c977743d133b5a0299c185ff3a4b1ca4672af5e33a5102543a0d96ff2f68c1f
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$aA3AD.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA3AD.bat
                                                                            • Size 722B
                                                                            • SHA256 46323968b6044d228d1a2025173c8a5e698ce7f39add9a529e18a07fe5375809
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$aA61E.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA61E.bat
                                                                            • Size 722B
                                                                            • SHA256 9030081c27e7e7741af94267366a44c0be31a593be369e0e2db59d2a0937e701
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$aA851.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA851.bat
                                                                            • Size 722B
                                                                            • SHA256 e86c614221a3fd7b12ad066706eb189bee1b5c0c2aeeceaea2f55972224e0f6a
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$aAB4E.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aAB4E.bat
                                                                            • Size 722B
                                                                            • SHA256 68daca77f0f1063ba65e1fd0bd5dffa2835f8c347bf955052efeec20e8407e9f
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$aB050.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB050.bat
                                                                            • Size 722B
                                                                            • SHA256 39f25cf57918d93ce86429aa0c210d646a24c64c970ebfd0f53bf3843a64dc83
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$aB205.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB205.bat
                                                                            • Size 722B
                                                                            • SHA256 6f156bf7967a690e36edf715ca484b32f80c4a4e8dd040611616c2f4fc49668c
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$aB503.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB503.bat
                                                                            • Size 722B
                                                                            • SHA256 3a5670a6594506eac1c81608435a7781fa4d277d976a35bd4613ed613588de10
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$aB8CC.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB8CC.bat
                                                                            • Size 722B
                                                                            • SHA256 ad4a773d3c104953aa78615de62b9cd7bae80ab42f24ed61411600b92a0d52a2
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$aBAC0.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aBAC0.bat
                                                                            • Size 722B
                                                                            • SHA256 d64164145499ee637070a6622fdcf76df681d22722bb0f79f44eef263d009640
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$aBCF2.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aBCF2.bat
                                                                            • Size 722B
                                                                            • SHA256 3aad928f74d4ec64a12d64366f6d2cb56a9222b646a2de9ee178e335e8f798bb
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$aC06D.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC06D.bat
                                                                            • Size 722B
                                                                            • SHA256 9483d605a89ae2504d2cdfcf9c5d2b3e2e09ea66f59d8bf74e0cbd22114f63aa
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            $$aC33B.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC33B.bat
                                                                            • Size 722B
                                                                            • SHA256 2c96f2b626577d29b3de465f414a9c755e048b9255b45c7f07164efb3038ac72
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.4MB
                                                                            • SHA256 e3c9688d1244eee56d90a7ea1f24d251c8414570a6383d06494b7c9264341d11
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.4MB
                                                                            • SHA256 79cadd02f4d54db52776d43a02f0e6890aa6a2a1aaca555b55982aeabbbdace8
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.3MB
                                                                            • SHA256 1b4a2aefdfffb9ecba2b4a118e5221d7009efe728a2be0afdc9f5adeab950c37
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.3MB
                                                                            • SHA256 aaeb23ea7927ff83911b074ef0aab15b95e4a05dfd0f6c9b2b074bb783856961
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.3MB
                                                                            • SHA256 5b70b35ba6f1c884dcc724259cdf48537d97425b167ddfe403db5513beb9f168
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.3MB
                                                                            • SHA256 f98025436ee3e29831c9e40ddda05713c948a440663b6cbf03c8ce819e8f4d36
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.1MB
                                                                            • SHA256 1dbc6f7b4a4c6d534c81f8ed5853ded4eba756b35ab0c8040496412334849707
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.2MB
                                                                            • SHA256 d67246bdeab44608b2c5bb67d8a04a5b1b35f474695869aae2d9f26676923e58
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.2MB
                                                                            • SHA256 222706b585642b65822a6e3ccaa1b5430071c8ff2017427404110b38d505bfcc
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.2MB
                                                                            • SHA256 9f3257420f8d509540d444be23d7ff2902af53aec7c875913f4758dafcb51c43
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.7MB
                                                                            • SHA256 897f84fdb2236b7023c9cf2a3019cdb19ad1962a3e5676bbb3ce40aa83d308fa
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.7MB
                                                                            • SHA256 1df320454f082bb227eb352edaeacfd0883d58d0d7beda657554411d29d82f62
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.7MB
                                                                            • SHA256 548f7095d92c0ef6ce1483cf4af85b40db83ad07e2d09877428a90dac05ad7de
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.6MB
                                                                            • SHA256 c8527f2a0254704145ca4ae204c55b979d660286d7fc1178c7c3dc093b619513
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.6MB
                                                                            • SHA256 79e6db25ac9691df1cf86f13055ecb9ff52d849881ff99ae5d53806256f2d260
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.6MB
                                                                            • SHA256 31669de3c39390a2b9962aaa0e1f8e257d7af97fdc1a47813626250c1447b1c0
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.5MB
                                                                            • SHA256 66c3ad75ecbaa6fa5c5cb6c13431454fdeafe3f3b6386f5a515aa7d77b8a5860
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.5MB
                                                                            • SHA256 641cac5d0bebf39aea7310075e05b97cf90cc4a28a7598f2bb1bf8da38a6758d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.5MB
                                                                            • SHA256 737dcdc1dd2e1582203f4c1f81094d59d9dfbc0886e57bcbea58baba8ae8daf3
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51.exe.exe
                                                                            • Size 3.4MB
                                                                            • SHA256 1f3e64f6f7004298e72722c9f8f425736828d8f1fa5e74652ec98040006bd0ef
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Logo1_.exe
                                                                            • Path C:\Windows\Logo1_.exe
                                                                            • Size 32KB
                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            _desktop.ini
                                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-2937465464-4167303362-2236413517-1000\_desktop.ini
                                                                            • Size 8B
                                                                            • SHA256 cb7bedc97bdd2d63203eb6ba133a1f2298106db82404f9055a36ff6d137d0f86
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            memory/116-2063-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/204-1972-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/344-2222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/596-2127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/636-57-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/648-2272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/760-2338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/760-2333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/976-2242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1180-2031-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1196-1984-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1288-2095-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1312-2026-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1392-2237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1404-2217-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1408-1894-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1408-1948-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1408-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1408-129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1540-2186-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1612-1997-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1672-2075-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1712-2202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1720-2002-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1732-2317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1808-2252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1864-2212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1880-2227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1892-1905-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1940-1441-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1948-2232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1960-2302-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/1972-2191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2212-2055-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2224-2047-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2376-29-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2384-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2436-1988-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2524-2267-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2536-2332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2548-1976-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2576-2292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2596-2111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2624-2027-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2628-2059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2680-2067-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2696-2262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2732-2327-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2748-2166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2760-2087-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2772-2181-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2784-242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2848-91-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2876-1957-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2876-1998-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/2944-2051-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3036-1280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3040-37-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3044-1081-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3160-133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3216-2322-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3260-2146-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3316-2115-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3364-2257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3376-50-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3516-1945-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3624-1968-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3676-1980-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3724-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3740-2297-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3788-1992-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3832-2307-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3840-2018-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3844-2091-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3888-2141-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3912-2136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3952-2079-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3956-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3976-1959-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/3984-2099-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4004-2156-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4012-2151-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4024-2107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4036-2006-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4140-2277-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4156-2197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4180-1938-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4220-2103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4304-2282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4308-2035-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4312-2131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4316-2039-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4320-2171-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4328-2022-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4420-2287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4448-2014-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4476-2176-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4532-1898-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4592-2207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4640-2119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4664-1964-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4728-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4728-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4800-2083-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4820-2161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4888-2312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4940-75-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4964-2043-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/4992-2123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/5012-2010-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/5072-2247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/5084-1674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download

                                                                            memory/5112-2071-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                            Download