Overview

overview

7

Static

static

3

61b0c4d2b4...12.exe

windows10-2004-x64

7

61b0c4d2b4...12.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/09/2026, 22:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
  • Size 4.5MB
  • Sample260926-2g4w1sshkd
  • SHA256 61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B8B.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4216
      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3368
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CA4.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:952
          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2168
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33C8.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1892
              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1260
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a795C.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1988
                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4016
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8505.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2064
                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:4944
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E1D.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1256
                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:2964
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9919.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2432
                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:2584
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA166.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:2252
                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:2320
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA917.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2108
                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:536
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB126.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:4600
                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:1552
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB694.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:1744
                                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:5044
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB86.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3428
                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3448
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFCC.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4740
                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2460
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC402.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2196
                                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2288
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE91.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1996
                                                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1644
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD548.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4728
                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1800
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAD6.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5032
                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1508
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE8F.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3536
                                                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5048
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE248.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5012
                                                                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                39⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5028
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5B3.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4240
                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:888
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE66E.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4008
                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3340
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6CC.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:208
                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2468
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE768.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4084
                                                                                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4072
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7F5.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1632
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:956
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8D0.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3984
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1160
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9D9.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2504
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1824
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA56.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2876
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1596
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAE3.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2980
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4860
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBED.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2772
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:2828
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED06.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:552
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:4280
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE1F.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:3800
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2668
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEDB.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:2096
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:4336
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF86.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:216
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2300
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFE4.bat
                                                                                                                                          68⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:2592
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:4776
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF071.bat
                                                                                                                                              70⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:4868
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:2412
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF13C.bat
                                                                                                                                                  72⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:904
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                    73⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:3068
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1A9.bat
                                                                                                                                                      74⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:2908
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                        75⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:408
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF246.bat
                                                                                                                                                          76⤵
                                                                                                                                                            PID:2588
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                              77⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:4508
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2D2.bat
                                                                                                                                                                78⤵
                                                                                                                                                                  PID:1052
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:4552
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF35F.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:4900
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:3820
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3CC.bat
                                                                                                                                                                          82⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:3288
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                            83⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:4068
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4B7.bat
                                                                                                                                                                              84⤵
                                                                                                                                                                                PID:4204
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:3716
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF572.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:4192
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:5080
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF63D.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                          PID:1784
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:3620
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF747.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:760
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:3052
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7F3.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:1072
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:4168
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF88F.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                        PID:4224
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:4752
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF91C.bat
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:1164
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4444
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF999.bat
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:1608
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:4492
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9F6.bat
                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                      PID:3304
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:2428
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAA2.bat
                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                            PID:1004
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:4220
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB1F.bat
                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                  PID:1976
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:4284
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC0A.bat
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:3868
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:3516
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC87.bat
                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:1140
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:2248
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD71.bat
                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:4152
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:4620
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE9A.bat
                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:4712
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:1028
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF55.bat
                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:3980
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:864
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFE2.bat
                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:392
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:4964
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40.bat
                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:3736
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:4404
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11A.bat
                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:3484
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:4520
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A7.bat
                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:1660
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:4744
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a243.bat
                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:1400
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:2532
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E0.bat
                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                PID:4356
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:3248
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35D.bat
                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:452
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:4848
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BA.bat
                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                          PID:5016
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:640
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a447.bat
                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:3828
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                  PID:4504
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D4.bat
                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:4832
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:2112
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a560.bat
                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:4164
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                            PID:3780
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CE.bat
                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                PID:4032
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:4212
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64B.bat
                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:3116
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                        PID:756
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B8.bat
                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:4596
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:2400
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a754.bat
                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                PID:1648
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                    PID:2368
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a800.bat
                                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                                        PID:3564
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          PID:1548
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87D.bat
                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:2116
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:4816
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a948.bat
                                                                                                                                                                                                                                                                                                                                                150⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:2136
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  PID:3264
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F4.bat
                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4864
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                        153⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:1956
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA90.bat
                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:2724
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:2520
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1D.bat
                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:3044
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3476
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6B.bat
                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:3976
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4308
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC9.bat
                                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3020
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              PID:3108
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55.bat
                                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3664
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:4568
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD30.bat
                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1724
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:2872
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBD.bat
                                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:620
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                167⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE78.bat
                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3936
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3724
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED6.bat
                                                                                                                                                                                                                                                                                                                                                                                                      170⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3616
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF43.bat
                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3948
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a106C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1900
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1186.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3772
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11E3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:744
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:176
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a129F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:464
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1389.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2020
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3208
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1000
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1483.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a157D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a160A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1687.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a183C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a188A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1994.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A40.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AEC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B78.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BF5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C53.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D4D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E09.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E95.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F32.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FDD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2089.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2174.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a231A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2387.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2452.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a256B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2608.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2750.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4792
                                                                                                                            • C:\Windows\Logo1_.exe
                                                                                                                              C:\Windows\Logo1_.exe
                                                                                                                              8⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Enumerates connected drives
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:2936
                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                net stop "Kingsoft AntiVirus Service"
                                                                                                                                9⤵
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:2436
                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                  10⤵
                                                                                                                                    PID:3604
                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Enumerates connected drives
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4148
                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                      3⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4124
                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                        4⤵
                                                                                                                          PID:212
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 996
                                                                                                                        3⤵
                                                                                                                        • Program crash
                                                                                                                        PID:3868
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 996
                                                                                                                        3⤵
                                                                                                                        • Program crash
                                                                                                                        PID:2872
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4148 -ip 4148
                                                                                                                    1⤵
                                                                                                                      PID:2960
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4148 -ip 4148
                                                                                                                      1⤵
                                                                                                                        PID:2404

                                                                                                                      Network

                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            $$a2B8B.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a2B8B.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 438debd72a13bfb2e26d10f31f12c7aa75fe87ea668fa169dd8bf461bb342776
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a2CA4.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a2CA4.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 963746d83d0444d846563431ab03bb9f3e083edb39c793f734eb27c8f84a2add
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a33C8.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a33C8.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 da9a63ed79419c524416a2670dd76d6b8e255c7048ed08c33adf5c6f575b01d6
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a795C.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a795C.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 dcb528e59a90c3bd9d14d52ae0f85b87e440c08ca6a126c437c4f5b0e988233c
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a8505.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8505.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 f8ba8d40ad549b1edd1a486c09db85753e727bbc7bebf760daa08b566bf7d0f2
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a8E1D.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8E1D.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 f9e2e579c25ca01d6cc2202a16745f5ccce972931881556867d0f55af661f270
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a9919.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9919.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 c49c5076000c2964476dd2799ea63a488b0782312bedd7f141bccfb6aa1e3337
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$aA166.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA166.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 cc1e08c6961067557c5f669ad74bf0132e7864fc53de20088f12c8522b901717
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$aA917.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA917.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 657becfad91293a6bbcb9e856cb17a85c01523ef81725ae5c36352ebd26ae1de
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$aB126.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB126.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 4141ede7c631edf6276a6a888f52d0ddf373cc6f669d58a2cc728306e63e67af
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$aB694.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB694.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 0aca20d14c8b78147d80e3bf10874d1c845345eb5d3faed3d3e4ccc7bce4c23b
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$aBB86.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aBB86.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 2b66b69318da254fcedeee2bcb1bf33f74c7617d7efd09c86351d7a8cc227e4f
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$aBFCC.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aBFCC.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 fde5e32bf0cca8aaaa6f13b69843333fd648b0e9e54dd8d03bb44a0da1d1f780
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$aC402.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC402.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 45af86284e339c655e0e9a078578cba2e6172b0a42a04d1066e9200cf5926e16
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$aCE91.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aCE91.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 d220422ab091eaaaf262bb7a15af77f3f4207b1cdb8632137a7c6f33f2ee7043
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$aD548.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aD548.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 da2a0b9483b1b7b7c026fa596d9c844a0fa0e330fa62c93f6eebe806fdeb65f5
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$aDAD6.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aDAD6.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 3233918384278cbcc57cc28c2e58cd37e3a79d2341ecd408f928b3691f200844
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$aDE8F.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aDE8F.bat
                                                                                                                            • Size 722B
                                                                                                                            • SHA256 80c24e0d4fbe85bd1302f6671fe787ac4e83b42398722e75f12408a67dbd9aa1
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe
                                                                                                                            • Size 4.3MB
                                                                                                                            • SHA256 1a97019342606d35cfce608b3b368f3dd024dac4781ea8f224e43695067cc641
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Size 4.4MB
                                                                                                                            • SHA256 f1c351d829ea9202e9570b5ab4ce513fc1a7ceeb2b32571ec472727ee87225eb
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Size 4.1MB
                                                                                                                            • SHA256 71a42357d7cfad0cab696d2e1dd578d2f670da004759d3cd2376f45033e83337
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Size 4.3MB
                                                                                                                            • SHA256 14bab8058f39685529c13b372fb01c324c75edd010c841b4b9861d601c19c1e4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Size 4.1MB
                                                                                                                            • SHA256 bac46d7d23989cbc58bfdbc1260a9c106f6dd6227238c120e085b3ece24138db
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Size 4.2MB
                                                                                                                            • SHA256 bf567066535efcf22d081f6f7100cafa431e2e49b245aded95282d5c7844b410
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Size 4.0MB
                                                                                                                            • SHA256 fb3c26e1ee23467d03f9078be789aa5acfaaa4b73bf16be3158ef6c6ddf4933e
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Size 4.2MB
                                                                                                                            • SHA256 b4e4649c1a7a97f25ce677bb2fab21407f77ae229838a4234d0126c578827aa0
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Size 3.9MB
                                                                                                                            • SHA256 b7f94338f7670c9da06d0b8e63f7c2003e943faded9c04b58894a7a1869c6163
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Size 4.1MB
                                                                                                                            • SHA256 ddb70bc77833f240b88617949ef774194e75fa5771e812b9104e37a38f68303b
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Size 4.4MB
                                                                                                                            • SHA256 c47f6781ddfb7bc9611ab1b0c70275ab88c8341b1f72a89c12ccc2f4342e716b
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Size 4.4MB
                                                                                                                            • SHA256 9f424aec6257ac7e9a28670c4ec2ff19af99bbe21732b7ef720d2952cca40387
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Size 4.0MB
                                                                                                                            • SHA256 679c6e3314f15026b9920607c82adedfe32099392340e2449d9e06e203c34b33
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Size 4.3MB
                                                                                                                            • SHA256 cb8403df1f0e1024cdd63abea9283c7e122a2bb581ac6051b62af036e22d1c9c
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Size 4.0MB
                                                                                                                            • SHA256 3d58c9772443b27a0b1788a6d8da1a1bf98a924460719e8536fd4e4bdec6fc2e
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Size 4.2MB
                                                                                                                            • SHA256 a91400cd58642f4b5c0b09373899d7da76c570aad9c89789b6458199079a2e4d
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Size 4.2MB
                                                                                                                            • SHA256 2e8514de6e677215024363f7cc6ef708c1757da7e6537e6fb52e6ebe47e18be6
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\61b0c4d2b481144496a40e66ca54a0553f4f768fde579b4a2016e833ecaf8d12.exe.exe
                                                                                                                            • Size 4.5MB
                                                                                                                            • SHA256 f9136fae1376ad07fd758078e663c0eb72d16e8a3c349f4589c345db3acc43f5
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Dll.dll
                                                                                                                            • Path C:\Windows\Dll.dll
                                                                                                                            • Size 68KB
                                                                                                                            • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Logo1_.exe
                                                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                                                            • Size 32KB
                                                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            _desktop.ini
                                                                                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-1846164713-4096795028-774071693-1000\_desktop.ini
                                                                                                                            • Size 9B
                                                                                                                            • SHA256 8fb79d95cb82ce6ed636296eb0672e78737e3fc202e2968d59070b05f6cd443b
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            memory/176-2279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/408-2035-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/536-1893-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/564-2425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/640-2149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/756-2174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/812-2420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/836-2375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/864-2115-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/888-1964-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/916-2385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/956-1981-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1000-2294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1028-2111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1080-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1080-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1112-2435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1160-1985-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1176-2355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1184-2289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1260-1841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1308-2395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1412-2445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1420-2390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1468-2430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1508-1951-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1548-2189-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1552-1900-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1596-1993-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1644-1936-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1644-1937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1760-2360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1772-2304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1800-1944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1824-1989-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1956-2204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2112-2159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2120-2370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2168-31-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2248-2103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2288-1929-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2300-2019-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2320-1886-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2368-2184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2400-2179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2412-2027-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2428-2087-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2460-1921-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2468-1973-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2520-2209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2532-2135-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2584-1879-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2608-2345-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2668-2011-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2696-2440-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2700-2249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2828-2002-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2872-2234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2916-2405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2936-1872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2936-1840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2936-1923-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2936-1873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2964-1870-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3016-2239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3052-2067-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3068-2031-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3080-2365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3108-2224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3248-2139-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3264-2199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3340-1968-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3368-21-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3368-17-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3372-2310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3436-2415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3448-1914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3476-2214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3516-2099-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3620-2063-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3716-2055-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3724-2244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3780-2164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3788-2269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3820-2047-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3940-2325-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3948-2254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3972-2400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4016-1852-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4016-1856-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4044-2461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4044-2456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4068-2051-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4072-1977-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4148-1829-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4148-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4168-2071-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4212-2169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4220-2091-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4244-2335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4252-2340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4280-2006-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4284-2095-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4308-2219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4316-2264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4336-2015-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4392-2455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4404-2123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4444-2079-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4492-2083-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4504-2154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4508-2039-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4512-2315-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4516-2450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4520-2127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4528-2350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4552-2043-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4568-2229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4620-2107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4704-2330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4744-2131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4752-2075-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4776-2023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4780-2274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4800-2410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4816-2194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4848-2144-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4852-2284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4860-1997-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4888-2320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4944-1863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4952-2299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4964-2119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5008-2380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5028-1960-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5036-2259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5044-1907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5048-1955-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5048-1956-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5080-2059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download