Overview

overview

7

Static

static

3

5624990215...c5.exe

windows10-2004-x64

7

5624990215...c5.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 22:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
  • Size 4.0MB
  • Sample260930-2g4w1stdje
  • SHA256 5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3312
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56D5.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:432
      • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
        "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:560
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5908.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1136
          • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
            "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1716
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CC1.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3408
              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4464
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FCE.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3664
                  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4864
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a627E.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3528
                      • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                        "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1484
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6608.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:4772
                          • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                            "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:984
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68C7.bat
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:2484
                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:3908
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B67.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:1200
                                  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:1904
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FCC.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:4344
                                      • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                        "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:1800
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7385.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:972
                                          • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                            "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:864
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a773E.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:3264
                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:3620
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A6B.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1816
                                                  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1176
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DB7.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3652
                                                      • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3772
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80F3.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3224
                                                          • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3416
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83F0.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1396
                                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5036
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8826.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4308
                                                                  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4504
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B05.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1912
                                                                      • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:540
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E22.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3600
                                                                          • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3084
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a917D.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4528
                                                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:552
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9594.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1828
                                                                                  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1824
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9824.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4460
                                                                                      • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3152
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98C0.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3612
                                                                                          • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4584
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a992E.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4544
                                                                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4736
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A09.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4496
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4540
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A95.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3380
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2764
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B51.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4336
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3744
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BFD.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2324
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1144
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C99.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3876
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1524
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D25.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2592
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:2272
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DB2.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:3760
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:844
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E1F.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:3784
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:2276
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E8D.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:4416
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:4384
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F0A.bat
                                                                                                                                      66⤵
                                                                                                                                        PID:4924
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:4140
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FB6.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:464
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4332
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA071.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:2544
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4304
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA10D.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:4432
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:4652
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1AA.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:208
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:2808
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA246.bat
                                                                                                                                                              76⤵
                                                                                                                                                                PID:3252
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:1696
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA330.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:2512
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:3552
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3DC.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:4268
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:2816
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA505.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:2252
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:900
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5EF.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                  PID:2620
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:1860
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6CA.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:4256
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                        87⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:2008
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA757.bat
                                                                                                                                                                                          88⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2428
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:1492
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7D4.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                                PID:2980
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:1604
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA880.bat
                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:4244
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:2508
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8FD.bat
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                          PID:3160
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:2464
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9A9.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                PID:908
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:3100
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA64.bat
                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:4768
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:3532
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB3F.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:2604
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:5016
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACF4.bat
                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                              PID:4588
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:1224
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD91.bat
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                    PID:3028
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:4756
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE6B.bat
                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:4700
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          PID:4628
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF27.bat
                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:2096
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:1648
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFC3.bat
                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                  PID:4672
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:1668
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB06F.bat
                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:3328
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:4976
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0EC.bat
                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:2364
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:3076
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB179.bat
                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:1792
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:1480
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1F6.bat
                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                    PID:1072
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:1836
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2E0.bat
                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:3800
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:3192
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB35D.bat
                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:2248
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:2444
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB428.bat
                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                  PID:5040
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                    125⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:1088
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4C4.bat
                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                        PID:3204
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                            PID:4724
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB64B.bat
                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:3964
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:2092
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB726.bat
                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:3792
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:3852
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB820.bat
                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                        PID:2968
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:4648
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8CC.bat
                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:364
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                PID:3932
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB997.bat
                                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                                    PID:3756
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                        PID:2812
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAA0.bat
                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                            PID:2560
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                                                PID:1672
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB7B.bat
                                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:4900
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:2540
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC37.bat
                                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                                        PID:5084
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                                            PID:1944
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCF2.bat
                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:5044
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:4688
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDCD.bat
                                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:2800
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:2032
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE98.bat
                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:4292
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:2664
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF15.bat
                                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:1596
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:4272
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFC1.bat
                                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:3036
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                PID:5020
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC02E.bat
                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2452
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3704
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0F9.bat
                                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:1508
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:4388
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC186.bat
                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:2120
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4136
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC232.bat
                                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:4676
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:880
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2ED.bat
                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4364
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:4412
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3B8.bat
                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:3884
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC464.bat
                                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3844
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    167⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC501.bat
                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC59D.bat
                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC649.bat
                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1384
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2872
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6F5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC791.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC86C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC917.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2128
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:948
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB3A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3740
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBA8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:968
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC54.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:816
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD0F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD8C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE19.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEE4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF70.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD00D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD08A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD116.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1B3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD23F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD358.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD462.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD50E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5AA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4536
                                                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                                                40⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                PID:3188
                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                  41⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                  PID:4120
                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                    42⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:844
                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                    C:\Windows\Logo1_.exe
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Enumerates connected drives
                                                                                                    • Drops file in Program Files directory
                                                                                                    • Drops file in Windows directory
                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4832
                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                      3⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2656
                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                        4⤵
                                                                                                          PID:2228
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 992
                                                                                                        3⤵
                                                                                                        • Program crash
                                                                                                        PID:4572
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 992
                                                                                                        3⤵
                                                                                                        • Program crash
                                                                                                        PID:4588
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4832 -ip 4832
                                                                                                    1⤵
                                                                                                      PID:2552
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4832 -ip 4832
                                                                                                      1⤵
                                                                                                        PID:1480

                                                                                                      Network

                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            $$a56D5.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a56D5.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 765d55f4d891c7eb2a7c045c0847b3f5eaf9ffa239c267e44d3ee28977b37942
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a5908.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a5908.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 f5aa31e3055856422348f2dcb13529539b131f79494fc4c61cd4e93ab87b5130
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a5CC1.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a5CC1.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 eb0ce02f460246a81c8f08020353f97407c337d23132c4b3c9619d0b341e28e6
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a5FCE.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a5FCE.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 5cfc38812d66817913c62f0f0862bb52532e86167358828cee9d0c17fd756b54
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a627E.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a627E.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 ce2a598c1746ac6c6a04495c53c8cbf19c5f132ca3496f6599f55007af823817
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a6608.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a6608.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 17508272ea3b428c8bc781261057371571b40ef58ed2fb5fd866ad8d607064c8
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a68C7.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a68C7.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 768a2676aed8934248e6056083ce396efaf8917da497a950e1620574902f22b6
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a6B67.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a6B67.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 0f6a2d8c1c520aac640b0aeaaa6b3e617714c5a15b71002dddab398f1aa06634
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a6FCC.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a6FCC.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 87cb91af359093e1fa909d4a84e3ab71ae0ab074409dcd60dec33cc823f9b017
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a7385.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a7385.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 7dde984ce1fd10e127148da8c7af4919e307e5d8be2731ffee6c45db0e30abfd
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a773E.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a773E.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 bb2a91f0be219017db810d8e03bf096a6c54e19d8f52654fe35813c7d8c7ea13
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a7A6B.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a7A6B.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 5b319eea28e9d84030aab7b6e1c7d1f445faaab8e8369b611b3522c15cb87386
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a7DB7.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a7DB7.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 19d2b4f3fd8f54c0c0442906f122249cbbb1694d9a1d67b7e074763a1f1e23dc
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a80F3.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a80F3.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 4bf99567be1c83c6b6ad1fb4ff5862b998f87d89db4ac887c9570d6155cb45e6
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a83F0.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a83F0.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 d65c438bbef7ea192d28021397881706e72d7b2debd6a4d0a79168d665d56798
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a8826.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8826.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 33aea510a168ff76f831cf3c7a101de866251840bcb7c941b63f860180854a96
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a8B05.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8B05.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 d49a3c220364bc10b7a21d44b9207960cab8d45706c506257a53c8c7a01ea51e
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a8E22.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8E22.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 ff114158353a47da100b7504b9ad49f4174249e678d2fa77748f15df4680e798
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a917D.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a917D.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 545821f3a92939772eac6b7bca04a8edffed7e4cfeafe275c34fb1aa0422c3a8
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.7MB
                                                                                                            • SHA256 1ba7f0dd3cd345752c58b57cc8c3413a4ba00a6bd5997fb4f1331478ba4bead7
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.6MB
                                                                                                            • SHA256 d5e3658e4f65e4dd2e8f8acf9fabc567f3f30fb76d154ca8d6d176681bb90b1d
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.6MB
                                                                                                            • SHA256 8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.5MB
                                                                                                            • SHA256 370381c6d9357ad3b820ca70d7b61b625bab47fa3e48774b0a54c48e12e32028
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.5MB
                                                                                                            • SHA256 633e1220dc5896061a2e84c98d8825827581d078a0d584ef05ba46314d2bf344
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.5MB
                                                                                                            • SHA256 ff21a3efda98f6498a963d175ae20fcbe6fe34f2e2243f44c99ebad4cf4e3181
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.4MB
                                                                                                            • SHA256 1392bae2fffb93942e12cc8a3ef294686ece48f75cfe0f93cfce38356f37d78e
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.4MB
                                                                                                            • SHA256 1f2d3bf24cdd2f6d5e7ead8b9b437034293c9f0f3832f807338d5aa830bd8a0f
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.9MB
                                                                                                            • SHA256 668e61e55273e0c4aee9745e03b296ae09675967c8f24f648a58576cdae39d4a
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.9MB
                                                                                                            • SHA256 efc17f73d8f69153686f34b26f48d59bd413779477c1c0d399ca9c9250c90ea3
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.9MB
                                                                                                            • SHA256 f53ab27df5dec3d1001b94507c960909a3ac7f1f5861eb3b74290061412b8066
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.8MB
                                                                                                            • SHA256 adf55bedaafd4b9a65efb7a0e29004a0d2297874e70cb7f42237cfd7859c2df4
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.6MB
                                                                                                            • SHA256 b96cb13c6c9b1d18c48d12fc9862a4102f93b49cd45447a6285631547acb32b1
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.3MB
                                                                                                            • SHA256 05802be7b298e5f517ca4cc41200fe43deb4308bdbfaeb8c843f3ed7418fe9a4
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.4MB
                                                                                                            • SHA256 456c4854a8e68bd3a7f67588419857dc77c701797b476a6aada3798e42b591c9
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.8MB
                                                                                                            • SHA256 e8363405bf753e72e54fe560673ece3974ac32df4c61ddb43df7b888b334bbec
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.8MB
                                                                                                            • SHA256 68c08e6f321b8d3f5a00a4f67780dd8a41861768bc0db07ad4bab47095ac09a4
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.7MB
                                                                                                            • SHA256 5caccd4d6677e2968fb323bb404887cbd82f06e7559fb533ed4049814c6381df
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5.exe.exe
                                                                                                            • Size 3.7MB
                                                                                                            • SHA256 4ff371f2fd9d57803c20cec9519b1ffb86420e64eeed07ea32da8e9085ba9bd5
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            Logo1_.exe
                                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                                            • Size 32KB
                                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            _desktop.ini
                                                                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-939655444-3071939294-1401108526-1000\_desktop.ini
                                                                                                            • Size 9B
                                                                                                            • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            memory/540-3582-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/552-3606-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/560-17-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/560-21-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/844-3653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/864-1856-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/880-3870-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/900-3697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/948-3930-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/984-71-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1080-3955-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1088-3781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1104-4015-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1144-3640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1176-2234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1224-3737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1364-4000-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1368-3910-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1436-3965-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1448-3975-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1480-3765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1484-62-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1492-3709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1524-3644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1552-3990-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1604-3713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1624-3905-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1632-3995-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1644-3880-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1648-3749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1668-3753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1672-3814-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1696-3685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1700-3970-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1704-3925-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1716-30-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1800-1831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1824-3610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1836-3769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1860-3701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1904-723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1944-3825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1952-4005-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2008-3705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2024-3940-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2032-3835-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2092-3789-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2200-3890-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2204-3950-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2272-3649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2276-3657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2444-3777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2464-3721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2508-3717-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2540-3819-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2664-3840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2764-3631-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2808-3681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2812-3809-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2816-3693-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2852-3980-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2872-3900-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3076-3761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3084-3589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3100-3725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3152-3614-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3188-3645-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3188-3605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3192-3773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3236-3885-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3312-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3312-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3416-2525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3452-3920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3512-3960-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3532-3729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3552-3689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3620-2017-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3684-4021-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3684-4016-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3704-3855-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3740-3935-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3744-3635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3772-2324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3780-3985-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3852-3794-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3908-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3932-3804-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4116-4010-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4136-3865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4140-3665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4272-3845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4304-3673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4332-3669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4340-3915-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4384-3661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4388-3860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4412-3875-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4464-44-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4504-3355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4540-3627-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4584-3619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4628-3745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4648-3799-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4652-3677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4668-3895-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4688-3830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4724-3785-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4736-3623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4756-3741-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4808-3945-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4832-3592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4832-1159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4832-2260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4832-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4864-51-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4976-3757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5016-3733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5020-3850-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5036-3176-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download