Overview

overview

7

Static

static

3

e35e1a28a7...a2.exe

windows10-2004-x64

7

e35e1a28a7...a2.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/09/2026, 14:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
  • Size 4.3MB
  • Sample260929-rxft1sscla
  • SHA256 e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4672
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AB6.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4224
      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:6124
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E7F.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2140
          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2620
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7248.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4508
              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2336
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74A9.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4572
                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:5948
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7749.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:5084
                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:4756
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A66.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:4736
                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1936
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CF6.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:1456
                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:3184
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8013.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4488
                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:3624
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B00.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4852
                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:1384
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E5B.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2260
                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:5076
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90EC.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:2096
                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:1908
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA36A.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2352
                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2308
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6D5.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1468
                                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5920
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA956.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5940
                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5524
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF61.bat
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3160
                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1640
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB174.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1520
                                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5784
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB414.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3232
                                                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1964
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8B7.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5136
                                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2936
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0C6.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3444
                                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2448
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC317.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:720
                                                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1432
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55A.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2100
                                                                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4652
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC75D.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5748
                                                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1044
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC828.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3200
                                                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5928
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC913.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1804
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5052
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA0D.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3252
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4684
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAC8.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2244
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4200
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBC2.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2680
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5688
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC7E.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4840
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4712
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD49.bat
                                                                                                                      58⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:6032
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:5560
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE24.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:852
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:2644
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEEF.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:4396
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:3632
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD027.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:5236
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:6028
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD140.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:5212
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:3652
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD20C.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:4744
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2864
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2C7.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:4704
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:3040
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3B1.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:3428
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:3724
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4AB.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:2896
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:2912
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD567.bat
                                                                                                                                                              76⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:5612
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:2596
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD632.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:4332
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:1984
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6FD.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                        PID:5832
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:3480
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7C8.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:2084
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:4788
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD893.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:2440
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:5240
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD96E.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:3056
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:4468
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA2A.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:1800
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                          89⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:3360
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAE5.bat
                                                                                                                                                                                            90⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:3496
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                              91⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:2952
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBC0.bat
                                                                                                                                                                                                92⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:4796
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:4624
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC7B.bat
                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:4324
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:3552
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD95.bat
                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                          PID:352
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:1744
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE6F.bat
                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:256
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:1920
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF3B.bat
                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:4320
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:1248
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFE6.bat
                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:4460
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:5508
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE100.bat
                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:2536
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:5340
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1AC.bat
                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                PID:856
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:5944
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE277.bat
                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:3288
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:4808
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE371.bat
                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:2916
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:4228
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE45B.bat
                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                              PID:4448
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:6044
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE517.bat
                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:2580
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:428
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5E2.bat
                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:5764
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:3576
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE68E.bat
                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:5092
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            PID:5068
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE759.bat
                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                PID:1868
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:1128
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE824.bat
                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:4836
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:4388
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8EF.bat
                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:1784
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:3764
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9D9.bat
                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:3300
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:5372
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA76.bat
                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:3696
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:2216
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB50.bat
                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                      PID:4584
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:1772
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC3B.bat
                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:4872
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                              PID:5368
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED15.bat
                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                  PID:5632
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:592
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE00.bat
                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:5676
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:1632
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE9C.bat
                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:2584
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                              PID:1696
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF67.bat
                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:5900
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                    PID:588
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF032.bat
                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      PID:5956
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        PID:3912
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0DE.bat
                                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:1740
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                            145⤵
                                                                                                                                                                                                                                                                                                                              PID:3220
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF18A.bat
                                                                                                                                                                                                                                                                                                                                146⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:4412
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                    PID:1208
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF246.bat
                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:1828
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                          PID:3364
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF301.bat
                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                              PID:1452
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:1564
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3EB.bat
                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:5652
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                    PID:2712
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF488.bat
                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:3124
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:3432
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF543.bat
                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5428
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              PID:4932
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF61E.bat
                                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3852
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4940
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6E9.bat
                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3780
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4564
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF785.bat
                                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:4512
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:2692
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF850.bat
                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:2624
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:4016
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF90C.bat
                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1756
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1912
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF999.bat
                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA64.bat
                                                                                                                                                                                                                                                                                                                                                                                                      170⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2076
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB1F.bat
                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBCB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC87.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2460
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD61.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:480
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2108
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF46.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2228
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFD2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a178.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a214.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a457.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a502.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a679.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a735.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a996.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA52.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD11.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE59.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF15.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a104D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1186.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1222.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a132B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4392
                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                          C:\Windows\Logo1_.exe
                                                                                                          2⤵
                                                                                                          • Creates a file in the Startup directory
                                                                                                          • Executes dropped EXE
                                                                                                          • Enumerates connected drives
                                                                                                          • Drops file in Program Files directory
                                                                                                          • Drops file in Windows directory
                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4996
                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                            3⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4776
                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                              4⤵
                                                                                                                PID:588

                                                                                                        Network

                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                              Reconnaissance

                                                                                                              Resource Development

                                                                                                              Initial Access

                                                                                                              Execution

                                                                                                              Command and Scripting Interpreter

                                                                                                              1
                                                                                                              T1059

                                                                                                              Windows Command Shell

                                                                                                              1
                                                                                                              T1059.003

                                                                                                              Persistence

                                                                                                              Boot or Logon Autostart Execution

                                                                                                              1
                                                                                                              T1547

                                                                                                              Registry Run Keys / Startup Folder

                                                                                                              1
                                                                                                              T1547.001

                                                                                                              Privilege Escalation

                                                                                                              Boot or Logon Autostart Execution

                                                                                                              1
                                                                                                              T1547

                                                                                                              Registry Run Keys / Startup Folder

                                                                                                              1
                                                                                                              T1547.001

                                                                                                              Defense Evasion

                                                                                                              Credential Access

                                                                                                              Credentials from Password Stores

                                                                                                              1
                                                                                                              T1555

                                                                                                              Credentials from Web Browsers

                                                                                                              1
                                                                                                              T1555.003

                                                                                                              Unsecured Credentials

                                                                                                              1
                                                                                                              T1552

                                                                                                              Credentials In Files

                                                                                                              1
                                                                                                              T1552.001

                                                                                                              Discovery

                                                                                                              Peripheral Device Discovery

                                                                                                              1
                                                                                                              T1120

                                                                                                              Query Registry

                                                                                                              1
                                                                                                              T1012

                                                                                                              System Information Discovery

                                                                                                              1
                                                                                                              T1082

                                                                                                              System Location Discovery

                                                                                                              1
                                                                                                              T1614

                                                                                                              System Language Discovery

                                                                                                              1
                                                                                                              T1614.001

                                                                                                              System Network Configuration Discovery

                                                                                                              1
                                                                                                              T1016

                                                                                                              Lateral Movement

                                                                                                              Collection

                                                                                                              Data from Local System

                                                                                                              1
                                                                                                              T1005

                                                                                                              Command and Control

                                                                                                              Exfiltration

                                                                                                              Impact

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              $$a6AB6.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6AB6.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 a95fc9607dedd78befc76ca8fcd827826b2b6016066d6bc99fc6905680973dde
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a6E7F.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6E7F.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 ca438fe164207cb60736c42c3df6c76ade5e09fbee822e5ab02ab1b109e5411e
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a7248.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a7248.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 583256c08c5c489d851372f65975448440dcfe6a514dccd91399c8cc207a18c6
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a74A9.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a74A9.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 37aea761af27a98df1daec4238da686f0f5a28904dc7103f14ae1cc67657cff6
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a7749.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a7749.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 cc9614608a47d53372a93613b511bd53d5d63724f5d64326921ed2b7217ad7e7
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a7A66.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a7A66.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 91a791863ee8be1d5d085bca1e895b6d9bd909d73e274d48080da69d19828708
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a7CF6.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a7CF6.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 6b19900571ae3f7ba78f591d0e1e65557ec5f7f0a4b11ed2bf2f21c78e8b5073
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a8013.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a8013.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 8daa8c337f759293febd956469a04f82140ea3cffa390a440e8de02ef07a8351
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a8B00.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a8B00.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 bed0f30238ccc4e0b15f09985e5e6df37d268e4b2fdf938e039054fa39db0c88
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a8E5B.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a8E5B.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 0b928d104f6cce05bf10980182c060ead2b495bd733f02d88a9f92e012c3eb36
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a90EC.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a90EC.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 90e9d6f806dec62ec037bfe0f8cd6ced76a464b587040277eb02ffa07da7597d
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$aA36A.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aA36A.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 49d3d8855a00c8adeb4cfe31557a046e08fd94b581e4cc1880fd3646b5f8dda5
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$aA6D5.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aA6D5.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 29a922337c2a13632b52dc9c3aa17f833fcdb094cbcc247bcc1bf8c784a67acc
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$aA956.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aA956.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 95d591260d6ceb3716530ac57c67dd6cc013917261bb6e75a6d3c575dc451b90
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$aAF61.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aAF61.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 c3e1df2cf2f35c96cfec7486235d664a6cd6eb8e59e7a2834cf407819526ee71
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$aB174.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aB174.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 97f19bb0a6cacefb4f9ec6000c3a636e9c0727e611f91e427a792dec7a0e89c9
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$aB414.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aB414.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 88de7660eb1ecddc8a561fc8296b2de431267ee8b7af656178e3fd00d5469277
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$aB8B7.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aB8B7.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 80d77280ccd1f7f810deb48065021a8a4834fc0532d734b02c7f6975895fa03b
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$aC0C6.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC0C6.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 2526545ca419bd6c6757f9c49d5fa624a868f7a42f3c0781bed7338d4718325e
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$aC317.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC317.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 6f73f8a626f9faae34b85271aa0fadcf9a5bf375267c091cf5ace53b4c7ff9cd
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$aC55A.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC55A.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 44f2b73323aa4c8fe8987cd562e463049aebc2a84e1a8041bd52adaa1eadb03b
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 4.0MB
                                                                                                              • SHA256 b169821ba02c346e2e429a5df882151b68e550227ab4b15b5a40dd62761ad2cb
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 3.9MB
                                                                                                              • SHA256 b59e7ecd8ed13713c99f5fc5c60be459c77ca7ac64426d103a5ede0afdc1d78a
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 3.9MB
                                                                                                              • SHA256 b90535f52a3528fbafbf3203f4edc5524f069a51f9f3e255af2119568039c341
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 3.8MB
                                                                                                              • SHA256 cc5b33b52f736eb9a598459115f010364a0de1efe85f36de5487af6818ca67e6
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 3.9MB
                                                                                                              • SHA256 5448f0c46a6b309f058b96def8c88d472b08e203cdb6a67b05a85e24bdebabf1
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 3.8MB
                                                                                                              • SHA256 221bea290d35b64032819fef256b6442b68c99d69555136615968f2592bfb59e
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 3.7MB
                                                                                                              • SHA256 69dbfebb3d6c4aea1948e6b4aea6bedc4095fe41da44d703459ea42fade03de9
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 3.8MB
                                                                                                              • SHA256 0d5d392bb660e03d86a151cc07f7c36360f17392bfac302501077d6009be49f2
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 3.7MB
                                                                                                              • SHA256 9e78b81add8d557d6e8de83062771ddc7ebdf38f77eefa6e6093f90ce20a4d08
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 4.1MB
                                                                                                              • SHA256 a24e48173ee9665045226ebb3b3f85b9f2d71f21e7f7d03cd59a40d1b793c055
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 4.1MB
                                                                                                              • SHA256 50b6f8e1d6e719618876412d9198183a7b0ebcc7d5a9cb516fb1e93c8f08fd1d
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 4.0MB
                                                                                                              • SHA256 4cc001dd57c6513b0a225c112ddac2b235b95433b5819c4a61151dd727236090
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 4.3MB
                                                                                                              • SHA256 3e4de16b5ea182eeae1fab8f0d79be01898f8ae8f6d6d7826d097fadaacf1692
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 4.3MB
                                                                                                              • SHA256 87e45572236502053012c3f5603de68cd49997f9c990a6b8d3283e747ab55cab
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 4.2MB
                                                                                                              • SHA256 e1e15b7b6c9ad4e8d0f7a14a8adcbedcf7f439b7629f6f8aba6b66eeb361c610
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 4.0MB
                                                                                                              • SHA256 244746f229095637ddda3e904b1414d4cc38945d7adee99e5bf7b5a532906b46
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 4.2MB
                                                                                                              • SHA256 48b81f8d9b04acd6418fa8f074854dcbf816cb876daa7938f89af130ab8cfd0f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 4.2MB
                                                                                                              • SHA256 46f618d422ee763a97f676a90996eacf2b70721498306c2ad591f647607280fa
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 4.2MB
                                                                                                              • SHA256 f02e87517a0633bdabc6e69bf12f3769c2f0d39a47789dd69244b71a28fbd327
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2.exe.exe
                                                                                                              • Size 4.1MB
                                                                                                              • SHA256 3ef9d780db4f8c594c056a396a3e3947ca0b1a22d923792c4b30b4305f30e86f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Logo1_.exe
                                                                                                              • Path C:\Windows\Logo1_.exe
                                                                                                              • Size 32KB
                                                                                                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              _desktop.ini
                                                                                                              • Path F:\$RECYCLE.BIN\S-1-5-21-1404337215-1550464601-2805570857-1000\_desktop.ini
                                                                                                              • Size 9B
                                                                                                              • SHA256 838cd29e86a897cab4f24311178626216bfb2c78875e82ccad2f629039bcbc8e
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              memory/428-8289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/472-8610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/540-8525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/588-8363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/592-8345-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1044-8113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1072-8507-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1128-8304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1208-8381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1248-8253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1280-8634-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1384-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1396-8598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1432-8102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1564-8393-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1632-8351-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1640-6068-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1696-8357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1744-8243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1772-8333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1884-8513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1908-5111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1912-8441-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1920-8248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1936-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1964-7007-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1984-8198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2076-8453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2104-8580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2212-8531-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2216-8327-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2308-5583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2324-8519-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2336-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2448-8092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2484-8622-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2596-8193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2620-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2644-8153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2692-8429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2712-8399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2744-8459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2764-8646-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2864-8173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2912-8188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2936-8084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2952-8228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3012-8495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3036-8628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3040-8178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3184-110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3220-8375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3344-8586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3348-8537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3352-8477-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3360-8223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3364-8387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3380-8616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3432-8405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3440-8664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3460-8658-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3480-8203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3488-8574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3512-8447-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3552-8238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3576-8294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3624-1849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3632-8158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3652-8168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3724-8183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3764-8315-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3824-8677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3824-8671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3912-8369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4016-8435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4024-8556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4128-8501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4200-8133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4228-8279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4264-8483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4388-8309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4468-8218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4536-8652-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4564-8423-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4624-8233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4652-8108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4672-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4672-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4684-8128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4688-8489-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4712-8143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4756-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4788-8208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4808-8274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4876-8543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4932-8411-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4940-8417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4996-6874-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4996-8254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4996-2399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4996-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4996-1308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5052-8123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5068-8299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5076-1865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5240-8213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5288-8670-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5332-8562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5340-8264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5368-8339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5372-8321-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5396-8465-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5440-8568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5452-8640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5504-8549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5508-8259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5524-6060-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5528-8471-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5560-8148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5572-8592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5688-8138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5784-6080-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5904-8604-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5920-5591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5928-8118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5944-8269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5948-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6028-8163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6044-8284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6124-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download