Overview

overview

7

Static

static

3

9df2cc753f...9b.exe

windows10-2004-x64

7

9df2cc753f...9b.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 05:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
  • Size 4.0MB
  • Sample260813-gp1jca1zas
  • SHA256 9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4328
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD66.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1364
      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4492
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4672
          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:5300
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a287.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4680
              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:3076
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a507.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3300
                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4832
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BD.bat
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:5624
                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1048
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EF.bat
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:2176
                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:5248
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB4.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3000
                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:5368
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC99.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4960
                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:2740
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8D.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:4652
                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:2204
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1081.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:4716
                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:5004
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1217.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1652
                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:5668
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15FF.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1404
                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    PID:2260
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CD5.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1092
                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                        27⤵
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5456
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E6B.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5364
                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5836
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F94.bat
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2340
                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:692
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30AB.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3636
                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:700
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31E4.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5952
                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1976
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33A9.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3736
                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4628
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a385C.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:996
                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5316
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3ACD.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4244
                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:900
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BE6.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5544
                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3516
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D7C.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5416
                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4348
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F51.bat
                                                                                              46⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3424
                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2676
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4675.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1632
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2168
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4760.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1340
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2224
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a481B.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2584
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2956
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48C7.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:756
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3476
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49B1.bat
                                                                                                                  56⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3264
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2104
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A7C.bat
                                                                                                                      58⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3876
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1660
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B48.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4468
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:928
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C03.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:5948
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:4544
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CBF.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:4400
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:6024
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D99.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:5992
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:3960
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E84.bat
                                                                                                                                          68⤵
                                                                                                                                            PID:5436
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2592
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F5E.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:2236
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3844
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a501A.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:4968
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:3492
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50E5.bat
                                                                                                                                                        74⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:3688
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:4720
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51B0.bat
                                                                                                                                                            76⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:2200
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                              77⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:5720
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52BA.bat
                                                                                                                                                                78⤵
                                                                                                                                                                  PID:5212
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:5588
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5366.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                        PID:4220
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:5960
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5421.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:4648
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:3400
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54EC.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                  PID:2352
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:2364
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55D7.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:5908
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                        87⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:5656
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56A2.bat
                                                                                                                                                                                          88⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:2384
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:3420
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a576D.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:1416
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:3052
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5877.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                    PID:5008
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:2016
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5961.bat
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                          PID:6092
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:4176
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A4B.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:2892
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:4856
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B26.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:5332
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:3304
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C01.bat
                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:2420
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:2228
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CEB.bat
                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:3712
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:4592
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DB6.bat
                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:3848
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:4100
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EA1.bat
                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:800
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:1196
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F8B.bat
                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                        PID:5724
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:4556
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6056.bat
                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                              PID:2804
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:3120
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6131.bat
                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                    PID:3008
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:2736
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61FC.bat
                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:2068
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:4456
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62E6.bat
                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:5280
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:5660
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63C1.bat
                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:2996
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:3488
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a648C.bat
                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                      PID:2308
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:1120
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6557.bat
                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:2600
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:252
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6623.bat
                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:3032
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:1156
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66EE.bat
                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                    PID:2820
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:2388
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a678A.bat
                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                          PID:3192
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:2252
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6855.bat
                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:4820
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:5912
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6901.bat
                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:2620
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:2816
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69DC.bat
                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:2312
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:1656
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AE5.bat
                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:2888
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:5568
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BDF.bat
                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:8
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                  PID:2640
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CAA.bat
                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:1636
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                        PID:2808
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D66.bat
                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                            PID:3500
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:4516
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E12.bat
                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:5896
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:2428
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EDD.bat
                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                      PID:5088
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        PID:1152
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FA8.bat
                                                                                                                                                                                                                                                                                                                                          148⤵
                                                                                                                                                                                                                                                                                                                                            PID:6132
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                                                PID:1724
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7083.bat
                                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:4740
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                      PID:552
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a712F.bat
                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:1212
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                          153⤵
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:4760
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71CB.bat
                                                                                                                                                                                                                                                                                                                                                            154⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:2296
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                              155⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              PID:5988
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7286.bat
                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4356
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1460
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7323.bat
                                                                                                                                                                                                                                                                                                                                                                        158⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:3540
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          PID:568
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73BF.bat
                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4224
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:124
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a745B.bat
                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:3084
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2040
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74F7.bat
                                                                                                                                                                                                                                                                                                                                                                                        164⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:5684
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3600
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7584.bat
                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7611.bat
                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2244
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a769D.bat
                                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a772A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7843.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78DF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1440
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:476
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a799B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A66.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B02.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1544
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C89.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D54.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E00.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EBB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F77.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8013.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80AF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a814C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8275.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8301.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a838E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a841A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8488.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8505.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8582.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a860E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5584
                                                                                        • C:\Windows\Logo1_.exe
                                                                                          C:\Windows\Logo1_.exe
                                                                                          2⤵
                                                                                          • Creates a file in the Startup directory
                                                                                          • Executes dropped EXE
                                                                                          • Enumerates connected drives
                                                                                          • Drops file in Program Files directory
                                                                                          • Drops file in Windows directory
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1748
                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                            3⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4796
                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                              4⤵
                                                                                                PID:1140

                                                                                        Network

                                                                                              MITRE ATT&CK Enterprise v16

                                                                                              Replay Monitor

                                                                                              Loading Replay Monitor...

                                                                                              Downloads

                                                                                              $$a1081.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a1081.bat
                                                                                              • Size 722B
                                                                                              • SHA256 9b3b958bc6a7849fa2a12649910dfe12e0a9530932cb4f1be0cb33dc5cdac8b6
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$a1217.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a1217.bat
                                                                                              • Size 722B
                                                                                              • SHA256 3781e983c78dd6b1daa1c1def4fa2b53fded39d881a381ac9dbcae7e82e17d35
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$a15FF.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a15FF.bat
                                                                                              • Size 722B
                                                                                              • SHA256 c5c8fe5079060194823fbd6717cff7516f9b33d2abb4e1d711b15cdce117109b
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$a1E6B.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a1E6B.bat
                                                                                              • Size 722B
                                                                                              • SHA256 6314b446c75b3e854543c21d9c88593e5dc04bd15ad4f12dbb7c8a29820572e1
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$a1F94.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a1F94.bat
                                                                                              • Size 722B
                                                                                              • SHA256 592c9e6bdd16d09e94ba1ed505eaf121925220017187bef6ebc8ead30a3e73f4
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$a287.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a287.bat
                                                                                              • Size 721B
                                                                                              • SHA256 a219c2560b6c83f3d06cc322cc8790a0cebcf93c3b2d84c7618015bf9a81e1c8
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$a30AB.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a30AB.bat
                                                                                              • Size 722B
                                                                                              • SHA256 268fcf86ddcc466b1650cf1dc104aac9f0a64b2f42456889b0febd2dcce93626
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$a31E4.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a31E4.bat
                                                                                              • Size 722B
                                                                                              • SHA256 6557a03e7ed69e62b932d185231774a19d72816cc34a820bfcd8fed502200c27
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$a33A9.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a33A9.bat
                                                                                              • Size 722B
                                                                                              • SHA256 1753ca5a083ff9a4fa364672bd52a63c16c8fdc0bc4dcf513d4e1aac297fe43f
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$a385C.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a385C.bat
                                                                                              • Size 722B
                                                                                              • SHA256 96d36b830f895aaf5551fc04d43e33e610eaf6a64b09c9d86032fa6e0508d7ef
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$a3ACD.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3ACD.bat
                                                                                              • Size 722B
                                                                                              • SHA256 a0c3e22c13e16e81ff897d48483231184c88c13ccc8e108eb8f3353e8985b87f
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$a3BE6.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3BE6.bat
                                                                                              • Size 722B
                                                                                              • SHA256 547d7bf661b8ac46c8a9a7ad05d4521f526246f3f1a4f942d1d8b529eea0957e
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$a3D7C.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3D7C.bat
                                                                                              • Size 722B
                                                                                              • SHA256 4433db3d5b45c32e0ff70cd7557b80d5ef9af7e7a8b8dc44e9239d48d5a3cab7
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$a44.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a44.bat
                                                                                              • Size 720B
                                                                                              • SHA256 cce52b989263fc97f9accfa9ecbc64d6d7cae232632fd29aba11f045e74cee7b
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$a507.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a507.bat
                                                                                              • Size 721B
                                                                                              • SHA256 56116eefd20d5c3d81f552e126f4c9808668e341c7c004ff4068b8aceea660d0
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$a6BD.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6BD.bat
                                                                                              • Size 721B
                                                                                              • SHA256 b8875f001b28ca4a81d10a69db14e415d5283ea749fdf33f3300cd49a25fbeb7
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$a8EF.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a8EF.bat
                                                                                              • Size 721B
                                                                                              • SHA256 87e683789ba7da750cf773db17791528d3cf6b8a040fdd6056f935e91155da22
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$aAB4.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aAB4.bat
                                                                                              • Size 721B
                                                                                              • SHA256 616027261a14153b0faeed9305ef9a3533979925834ac5d1bf7697cbd67d176c
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$aC99.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC99.bat
                                                                                              • Size 721B
                                                                                              • SHA256 426689425ace8dc12935c269aa476d0f920e81f89ab1a3027e1ffbe0bcf91615
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$aE8D.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aE8D.bat
                                                                                              • Size 721B
                                                                                              • SHA256 3391e14bc4b31344ecd038a6832af1f50a2fdbb0f9e8992d2197f3003ccefc90
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              $$aFD66.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aFD66.bat
                                                                                              • Size 722B
                                                                                              • SHA256 0af694d83d6ae92adee7fcf8ed2d6fe442f2f7aef22bc2315fc6145900cb0206
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.4MB
                                                                                              • SHA256 d7c183536cc7fd930fd2ec1ea0604d92b4930a53dc8ab9b8c1d166d41397d0be
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.3MB
                                                                                              • SHA256 24a55b3653076593b025764ac18861040a0fd4333ca904d84ed47503b9a4e130
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.3MB
                                                                                              • SHA256 be77412d8db2c2137a9ea373575d21795738328e254b4296185153b084aa6dd4
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.4MB
                                                                                              • SHA256 c1f38a2922b73825f3f3bb1416386cba3d4f816dac2202bed2be30ad915f9d62
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.3MB
                                                                                              • SHA256 9ca965091a08cffe8a7e864eb3f882489db00a65281010da0cb5f17e65785785
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.5MB
                                                                                              • SHA256 c6c59fac7f6d76bfa3e99637c2443695964b0e3991b45b1ce286c2208da93703
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.6MB
                                                                                              • SHA256 6b1d37e21a70161530dbf39c8f882e76476550f16fab781d6ffe86226776e8ad
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.4MB
                                                                                              • SHA256 b5e51c30aefb23a9fd0dd44d66af3afe998d199f16bf3ebfc3344f8cc1cc5c8b
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.5MB
                                                                                              • SHA256 47ca4781f1b90a855bdc81a8c78c4447bd91127f97777ad8413e90d8307987d2
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.9MB
                                                                                              • SHA256 f1ceb48d5a646e1266d85218f39f27e6e861929353c1f4b56d0fd73c4dc8670d
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.9MB
                                                                                              • SHA256 ebb99cd71fe7ebc17ece3f6f2052d2a7a7065525912f6a055a2371e3e9d081d3
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.8MB
                                                                                              • SHA256 1b7b753465a529cd6de54025bd7db05bd725cb3ef60ae68d714be3a7147b77ce
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.7MB
                                                                                              • SHA256 8961dc20df9192d1b35821d2d26cfd1e65a083c28db44ca48acf3867e44f4a8a
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.9MB
                                                                                              • SHA256 04a6ad0c30ed07c931cbd0282aa4167fd78f76ff3375002177d864b2892460a0
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.8MB
                                                                                              • SHA256 59a6fc8d28cf84d0b970eefed7541ecb5286deacab26ce97505eccf08a4174ad
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.6MB
                                                                                              • SHA256 89d023d1cb4032413a775fedcb5b1dff2c2eee68038d9bb3274c4268a7a55a32
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.8MB
                                                                                              • SHA256 627da9f04657051d1f70e7420bcce92a8d8cf6c7a6deafe3db0b07400ccec802
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.7MB
                                                                                              • SHA256 6825c047f554f6c47055a5b5fca872483d211efc99fbbcec352c00d54603131a
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.7MB
                                                                                              • SHA256 9231b94d8ae45f068fbd96a122d55f6c14ee3b5f6cdb753ee6f3e6867abc41dd
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9df2cc753fbd70c2f9153d9cc899588b0d2c91c2586e7c0391c45eb122cf539b.exe.exe
                                                                                              • Size 3.6MB
                                                                                              • SHA256 352e4d77efe10961c57b24f355acbfe6cacf9adaded249933575bd6acc6b83a2
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Logo1_.exe
                                                                                              • Path C:\Windows\Logo1_.exe
                                                                                              • Size 32KB
                                                                                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              _desktop.ini
                                                                                              • Path F:\$RECYCLE.BIN\S-1-5-21-3611646547-550105268-947503007-1000\_desktop.ini
                                                                                              • Size 9B
                                                                                              • SHA256 2ef572b16408784c924887853b6865cbb5f2ade2f877f17ee91c4af1bf1cff51
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              memory/124-8395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/252-8281-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/476-8449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/552-8364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/568-8389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/692-5603-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/700-5611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/900-6108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/928-8126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/988-8570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/988-8576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/1048-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/1048-1886-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/1120-8276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/1152-8352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/1156-8286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/1196-8241-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/1332-8515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/1460-8383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/1512-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/1656-8316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/1660-8120-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/1724-8358-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/1748-3138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/1748-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/1748-8121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/1748-106-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/1976-5619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2016-8206-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2040-8401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2104-8115-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2168-8093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2204-102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2224-8098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2228-8226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2252-8298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2260-1877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2364-8186-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2388-8292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2428-8346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2592-8146-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2624-8419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2640-8328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2672-8485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2676-8088-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2736-8256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2740-94-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2808-8334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2816-8310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2864-8479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/2956-8103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/3052-8201-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/3076-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/3120-8251-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/3304-8221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/3400-8181-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/3408-8473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/3420-8196-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/3476-8110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/3488-8271-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/3492-8156-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/3516-6116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/3600-8407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/3844-8151-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/3892-8443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/3948-8533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/3960-8141-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4100-8236-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4144-8551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4176-8211-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4268-8509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4328-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4328-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4348-6122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4456-8261-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4464-8503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4492-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4516-8340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4532-8455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4544-8131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4556-8246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4592-8231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4628-6088-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4676-8539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4688-8563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4720-8161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4760-8370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4832-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4856-8216-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/4860-8461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5004-111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5052-8497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5104-8527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5124-8413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5136-8437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5248-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5268-8431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5300-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5316-6096-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5368-85-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5400-8545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5456-1882-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5464-8467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5556-8557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5568-8322-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5588-8171-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5656-8191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5660-8266-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5668-461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5720-8166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5836-1891-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5912-8304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5960-8176-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5984-8521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/5988-8376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/6024-8136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/6108-8569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download

                                                                                              memory/6112-8491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                              Download