Overview

overview

7

Static

static

3

9df2cc753f...9b.exe

windows10-2004-x64

7

9df2cc753f...9b.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/08/2026, 05:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
  • Size 4.0MB
  • Sample260813-gp1jca1zas
  • SHA256 9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1020
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16CF.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4932
      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:5100
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1921.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2976
          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2832
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BE0.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4688
              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:2204
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1ECE.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:704
                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:4760
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20B2.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4852
                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:588
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22F4.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4844
                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4324
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2517.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4728
                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:364
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a271B.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4716
                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2024
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a290F.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2884
                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:4740
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B80.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:3308
                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:1568
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3023.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4252
                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:1168
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a317B.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4480
                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3780
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a364D.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1052
                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1756
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38CE.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4600
                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1956
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4253.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1512
                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2692
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a439C.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3120
                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3508
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4707.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1300
                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4744
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4939.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4748
                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4432
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4ACF.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3168
                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5068
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D02.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2476
                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4556
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D9E.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3100
                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4188
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E3A.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3240
                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4684
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EF6.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1720
                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3452
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F82.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2172
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4492
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FFF.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3420
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1000
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a509C.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3304
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2200
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5167.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4200
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4820
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51E4.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4048
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4540
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5290.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:216
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:2908
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a531C.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:3772
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:2152
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53A9.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:3360
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:2820
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5445.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:2472
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:2084
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54B3.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:4208
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:4800
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a557E.bat
                                                                                                                                          68⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:4712
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:5080
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a560A.bat
                                                                                                                                              70⤵
                                                                                                                                                PID:680
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:2552
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56B6.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:2604
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:1872
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5762.bat
                                                                                                                                                        74⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:4560
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:3932
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57EF.bat
                                                                                                                                                            76⤵
                                                                                                                                                              PID:4108
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:4420
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a588B.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:2748
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:4172
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5937.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:3740
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:3204
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59E3.bat
                                                                                                                                                                          82⤵
                                                                                                                                                                            PID:3292
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:4372
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A6F.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:3084
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:888
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BB7.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:1608
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:4512
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C25.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:3644
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                          89⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:1740
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CD1.bat
                                                                                                                                                                                            90⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:4864
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                              91⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:3720
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D8C.bat
                                                                                                                                                                                                92⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:1952
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:60
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E28.bat
                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:3008
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:4380
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EB5.bat
                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                          PID:4776
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:2744
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F32.bat
                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                PID:2856
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:1704
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FFD.bat
                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:2364
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:5116
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60F7.bat
                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:4696
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:2416
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6184.bat
                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:2888
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:3200
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6220.bat
                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                  PID:1760
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:380
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a629D.bat
                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:4608
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:2720
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6349.bat
                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:4388
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:988
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63C6.bat
                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:4460
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:3228
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6443.bat
                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:1196
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:4132
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64D0.bat
                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:4792
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:1160
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a657B.bat
                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:5036
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:4928
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65F8.bat
                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:2224
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:3724
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6685.bat
                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                    PID:1068
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:1424
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a677F.bat
                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                          PID:2344
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:2776
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a684A.bat
                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                PID:1124
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:2304
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68D7.bat
                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:2592
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                        PID:2724
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6973.bat
                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:3324
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:2616
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69F0.bat
                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:3020
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                  PID:2756
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A7D.bat
                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:4880
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:844
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B09.bat
                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                          PID:4564
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:3860
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BA6.bat
                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:4060
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:1280
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C32.bat
                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:1920
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    PID:468
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C90.bat
                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                        PID:4976
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:540
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D4B.bat
                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:1176
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                              145⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:4068
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DC8.bat
                                                                                                                                                                                                                                                                                                                                146⤵
                                                                                                                                                                                                                                                                                                                                  PID:4644
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:1260
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EA3.bat
                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      PID:2044
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        PID:5060
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F30.bat
                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:3372
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:4220
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FBC.bat
                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:4284
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2380
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7049.bat
                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2156
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:4700
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7105.bat
                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:4064
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4604
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71A1.bat
                                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:1716
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                  159⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:4000
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a722D.bat
                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:3992
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:904
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72AA.bat
                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:1680
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:5112
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7337.bat
                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3680
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:3792
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73D3.bat
                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:868
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:3948
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7460.bat
                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4652
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                            169⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:3492
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74DD.bat
                                                                                                                                                                                                                                                                                                                                                                                              170⤵
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:3596
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a754A.bat
                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3604
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7692.bat
                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            177⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a770F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1836
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7809.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4052
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7971.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:212
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3896
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A7A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3960
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B46.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:920
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BB3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CCC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D49.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E05.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E72.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F3D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FD9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8066.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80E3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8160.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a822B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8373.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a841F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84AC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2076
                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                        32⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Enumerates connected drives
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                        PID:4636
                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                          33⤵
                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                          PID:3944
                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                            34⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:4152
                                                                          • C:\Windows\Logo1_.exe
                                                                            C:\Windows\Logo1_.exe
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Enumerates connected drives
                                                                            • Drops file in Program Files directory
                                                                            • Drops file in Windows directory
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1288
                                                                            • C:\Windows\SysWOW64\net.exe
                                                                              net stop "Kingsoft AntiVirus Service"
                                                                              3⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4120
                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                4⤵
                                                                                  PID:3444
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 1000
                                                                                3⤵
                                                                                • Program crash
                                                                                PID:2780
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1288 -ip 1288
                                                                            1⤵
                                                                              PID:2656

                                                                            Network

                                                                                  MITRE ATT&CK Enterprise v16

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  $$a16CF.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a16CF.bat
                                                                                  • Size 722B
                                                                                  • SHA256 1b59c1b99562cd03408b1b0cba7da660083e0343f527c8d14b1ff3b15125211f
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  $$a1921.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a1921.bat
                                                                                  • Size 722B
                                                                                  • SHA256 9af43bfd297b98d4cf1ff46d9a5c6626b78d650d34c464511975fcf5e77879dd
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  $$a1BE0.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a1BE0.bat
                                                                                  • Size 722B
                                                                                  • SHA256 cbd76eaaf4d17b45c3c9a5372b2141f778c488002cc6b3c8d7fb94d2063c5862
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  $$a1ECE.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a1ECE.bat
                                                                                  • Size 722B
                                                                                  • SHA256 ee70379e2a34f51e611dde2a563f446a12d86db234d38c7cbf7ed330a8b724ad
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  $$a20B2.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a20B2.bat
                                                                                  • Size 722B
                                                                                  • SHA256 23f2be19d19406d6974be0aa52ae971d7e475a9dc89bb8e88eed242ac1455b11
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  $$a22F4.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a22F4.bat
                                                                                  • Size 722B
                                                                                  • SHA256 50969b8581887544e1ede6fa6ea6256e84b117bc46497acb87f708638436c6f0
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  $$a2517.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a2517.bat
                                                                                  • Size 722B
                                                                                  • SHA256 14f1ae3a7ecd670f40c864e9447158e5dc364b3a3b75f7f4084a372d82d1ea2c
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  $$a271B.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a271B.bat
                                                                                  • Size 722B
                                                                                  • SHA256 ed2bb7dbc7e67989fbac35e5c891ca79b2247494b302391b232f4dd2c951f122
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  $$a290F.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a290F.bat
                                                                                  • Size 722B
                                                                                  • SHA256 4094f35b743115eb075449f55e747dc0acd8ac8696dea6137f6db76ce695fef1
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  $$a2B80.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a2B80.bat
                                                                                  • Size 722B
                                                                                  • SHA256 26a2d4b07d14892614a3aac29678475319cb221f2b24a82eac1091a95f6a27f9
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  $$a3023.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a3023.bat
                                                                                  • Size 722B
                                                                                  • SHA256 97c0b1371578667b380e3a759843c309c3c6be5483eba860e4187482171991a9
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  $$a317B.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a317B.bat
                                                                                  • Size 722B
                                                                                  • SHA256 681498831dc39f107716ee4b9ec925d1dc803fee1fee48088940c723c43b8a8a
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  $$a364D.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a364D.bat
                                                                                  • Size 722B
                                                                                  • SHA256 b41c409f5921d50f5cae52ca63c0c067a3115d88fac2480f5a90382b7b4a1183
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  $$a38CE.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a38CE.bat
                                                                                  • Size 722B
                                                                                  • SHA256 0efa1eb519657f0a3371d7faf3c66a907fc38f934beddaebd5591581a921cf79
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  $$a4253.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4253.bat
                                                                                  • Size 722B
                                                                                  • SHA256 01570e0d0adab31a3ea4f226d529047b19c3c59a8572b2b6d7a6b725e4c62c7e
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  $$a439C.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a439C.bat
                                                                                  • Size 722B
                                                                                  • SHA256 1470fe3654d4a97310a37f448ebefc37723342df888ac668ddd26adaec4e60a2
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  $$a4707.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4707.bat
                                                                                  • Size 722B
                                                                                  • SHA256 6da051ba3b9ff3fcb6913f118393f7c9d28d63e522ed7f664584db0a0a943e43
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  $$a4939.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4939.bat
                                                                                  • Size 722B
                                                                                  • SHA256 1c19ea3c78749be2c1343cd853ace45281b981725af2d698ec1cf4e50cdae175
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                  • Size 3.5MB
                                                                                  • SHA256 c6c59fac7f6d76bfa3e99637c2443695964b0e3991b45b1ce286c2208da93703
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Size 3.6MB
                                                                                  • SHA256 89d023d1cb4032413a775fedcb5b1dff2c2eee68038d9bb3274c4268a7a55a32
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Size 3.6MB
                                                                                  • SHA256 6b1d37e21a70161530dbf39c8f882e76476550f16fab781d6ffe86226776e8ad
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Size 3.5MB
                                                                                  • SHA256 47ca4781f1b90a855bdc81a8c78c4447bd91127f97777ad8413e90d8307987d2
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Size 3.7MB
                                                                                  • SHA256 8961dc20df9192d1b35821d2d26cfd1e65a083c28db44ca48acf3867e44f4a8a
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Size 3.5MB
                                                                                  • SHA256 05cd9b4184ceaa716f51422bed64dde2ec1b1d7b45cd7dc382340fd0ffef8d89
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Size 3.4MB
                                                                                  • SHA256 d7c183536cc7fd930fd2ec1ea0604d92b4930a53dc8ab9b8c1d166d41397d0be
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Size 3.4MB
                                                                                  • SHA256 b5e51c30aefb23a9fd0dd44d66af3afe998d199f16bf3ebfc3344f8cc1cc5c8b
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Size 3.9MB
                                                                                  • SHA256 ebb99cd71fe7ebc17ece3f6f2052d2a7a7065525912f6a055a2371e3e9d081d3
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Size 3.4MB
                                                                                  • SHA256 c1f38a2922b73825f3f3bb1416386cba3d4f816dac2202bed2be30ad915f9d62
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Size 3.8MB
                                                                                  • SHA256 1b7b753465a529cd6de54025bd7db05bd725cb3ef60ae68d714be3a7147b77ce
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Size 3.8MB
                                                                                  • SHA256 59a6fc8d28cf84d0b970eefed7541ecb5286deacab26ce97505eccf08a4174ad
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Size 3.7MB
                                                                                  • SHA256 6825c047f554f6c47055a5b5fca872483d211efc99fbbcec352c00d54603131a
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Size 3.9MB
                                                                                  • SHA256 f1ceb48d5a646e1266d85218f39f27e6e861929353c1f4b56d0fd73c4dc8670d
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Size 3.6MB
                                                                                  • SHA256 352e4d77efe10961c57b24f355acbfe6cacf9adaded249933575bd6acc6b83a2
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Size 3.9MB
                                                                                  • SHA256 04a6ad0c30ed07c931cbd0282aa4167fd78f76ff3375002177d864b2892460a0
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Size 3.8MB
                                                                                  • SHA256 627da9f04657051d1f70e7420bcce92a8d8cf6c7a6deafe3db0b07400ccec802
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                  • Size 3.7MB
                                                                                  • SHA256 9231b94d8ae45f068fbd96a122d55f6c14ee3b5f6cdb753ee6f3e6867abc41dd
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Dll.dll
                                                                                  • Path C:\Windows\Dll.dll
                                                                                  • Size 68KB
                                                                                  • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Logo1_.exe
                                                                                  • Path C:\Windows\Logo1_.exe
                                                                                  • Size 32KB
                                                                                  • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  _desktop.ini
                                                                                  • Path F:\$RECYCLE.BIN\S-1-5-21-2937465464-4167303362-2236413517-1000\_desktop.ini
                                                                                  • Size 9B
                                                                                  • SHA256 2ef572b16408784c924887853b6865cbb5f2ade2f877f17ee91c4af1bf1cff51
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  memory/60-2667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/224-2921-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/364-75-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/380-2695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/468-2771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/540-2776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/588-57-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/844-2756-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/864-2946-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/888-2651-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/904-2821-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/988-2703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1000-2583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1020-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1020-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1160-2715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1168-614-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1204-2961-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1260-2786-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1280-2766-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1288-2448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1288-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1288-135-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1288-2515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1424-2727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1568-414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1704-2679-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1740-2659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1756-2022-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1836-2866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1872-2627-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/1956-2452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2024-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2084-2611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2152-2603-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2200-2587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2204-37-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2240-2881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2304-2735-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2380-2801-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2416-2687-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2436-2911-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2552-2623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2616-2745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2632-2966-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2660-2967-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2660-2972-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2692-2529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2720-2699-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2724-2740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2744-2675-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2756-2750-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2776-2731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2820-2607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2832-29-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/2908-2599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3200-2691-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3204-2643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3228-2707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3328-2856-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3452-2574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3492-2841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3508-2536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3604-2851-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3688-2931-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3716-2956-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3720-2663-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3724-2723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3780-1869-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3792-2831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3852-2926-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3860-2761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3880-2876-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3896-2886-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3908-2916-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3932-2631-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3948-2836-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/3960-2891-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4000-2816-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4068-2781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4132-2711-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4172-2639-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4188-2566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4220-2796-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4296-2861-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4324-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4348-2941-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4360-2906-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4372-2647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4380-2671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4420-2635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4432-2554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4492-2578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4512-2655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4540-2595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4544-2951-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4556-2562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4604-2811-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4636-2579-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4636-2528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4676-2871-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4684-2570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4700-2806-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4740-91-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4744-2545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4760-50-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4800-2615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4820-2591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4856-2901-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4876-2846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4928-2719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/4968-2936-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/5060-2791-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/5068-2558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/5076-2896-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/5080-2619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/5100-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/5112-2826-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download

                                                                                  memory/5116-2683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                  Download