Overview

overview

7

Static

static

3

31c270fde6...80.exe

windows10-2004-x64

7

31c270fde6...80.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 06:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
  • Size 3.1MB
  • Sample260930-grf8gssfpc
  • SHA256 31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
    "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3204
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a906F.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5768
      • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
        "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5984
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a966A.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4500
          • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
            "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4548
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9929.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4540
              • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:236
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BF8.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3528
                  • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                    "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3388
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EF5.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5948
                      • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                        "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:3844
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0E9.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:5880
                          • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                            "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:1272
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA34B.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:5392
                              • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:952
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5EB.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:936
                                  • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                    "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:4036
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0D8.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2516
                                      • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                        "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:5076
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB56B.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1480
                                          • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                            "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:5616
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB77F.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:6024
                                              • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:4864
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDE7.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3560
                                                  • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:916
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFDB.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3408
                                                      • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2768
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC28B.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:800
                                                          • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5872
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3B4.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3884
                                                              • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4344
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5C7.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2440
                                                                  • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4592
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7DA.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5740
                                                                      • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2804
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9CE.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2200
                                                                          • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:848
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB64.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4300
                                                                              • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3056
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDB6.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4084
                                                                                  • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5236
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFBA.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5344
                                                                                      • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1876
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1BD.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1064
                                                                                          • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3924
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3F0.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5368
                                                                                              • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2032
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD661.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3564
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1448
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD799.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1760
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2740
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8D2.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:568
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3264
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9EB.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4232
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3364
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB43.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5048
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3292
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC3D.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:5420
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:5352
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD66.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:5520
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:5360
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE7F.bat
                                                                                                                              62⤵
                                                                                                                                PID:5308
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:2928
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFD7.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:5792
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:4952
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE11F.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:2704
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:3616
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE267.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:476
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2408
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE390.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:5232
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:2900
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4D8.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:5396
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:4712
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5F1.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:4944
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:2720
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE759.bat
                                                                                                                                                              76⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:2908
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4280
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8A1.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:3168
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:2520
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9E9.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                        PID:5060
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:200
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB50.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                              PID:5624
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:5688
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED15.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:1964
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:4596
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE3E.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                        PID:5492
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:4324
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF77.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:2504
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:4580
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0A0.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:3080
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:2580
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1C9.bat
                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:2616
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:4656
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF340.bat
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:564
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:3552
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF497.bat
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:3368
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:2756
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5A1.bat
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:4568
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:1892
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6AB.bat
                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:2436
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:1380
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF802.bat
                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:2560
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:3740
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF92B.bat
                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:2088
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:4524
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA64.bat
                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:5892
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:5572
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB9C.bat
                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                      PID:4272
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:3280
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCC5.bat
                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:5464
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:2764
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDEE.bat
                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:4328
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:1512
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEB9.bat
                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:3032
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:5160
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFB3.bat
                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                        PID:4588
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:4920
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD.bat
                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:1344
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:1348
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A7.bat
                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:832
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:5664
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a291.bat
                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:5340
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                        PID:5760
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CA.bat
                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:1568
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:3532
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F3.bat
                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:5476
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:4804
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62B.bat
                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                    PID:4612
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:1132
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a735.bat
                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:4448
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                            PID:4240
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86D.bat
                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:3004
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:2788
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a996.bat
                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:2300
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:3324
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABF.bat
                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:1424
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:2388
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC9.bat
                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                            PID:828
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:5528
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD2.bat
                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:1848
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:5332
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEC.bat
                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                      PID:5976
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                          PID:5428
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF05.bat
                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:4744
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                              145⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:3916
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE0.bat
                                                                                                                                                                                                                                                                                                                                146⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:2892
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:4720
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10BA.bat
                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:5960
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                      149⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:2584
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11F3.bat
                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:2188
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          PID:6028
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12CE.bat
                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:4836
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              PID:6044
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13B8.bat
                                                                                                                                                                                                                                                                                                                                                154⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:1388
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                  155⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3024
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1483.bat
                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                        PID:6052
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4236
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a157D.bat
                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:5564
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                PID:2420
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1677.bat
                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3104
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:692
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1771.bat
                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:2824
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5912
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a183C.bat
                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3696
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:4160
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18E8.bat
                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1708
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5388
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19E2.bat
                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:1268
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:3360
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B69.bat
                                                                                                                                                                                                                                                                                                                                                                                                      172⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1384
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C53.bat
                                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a202C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4044
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a228D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2387.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2452.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4972
                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                  46⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                  PID:5128
                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                    47⤵
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:4172
                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                      48⤵
                                                                                                                                                        PID:3696
                                                          • C:\Windows\Logo1_.exe
                                                            C:\Windows\Logo1_.exe
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Enumerates connected drives
                                                            • Drops file in Program Files directory
                                                            • Reads the TCP/IP host and domain name from the registry
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4808
                                                            • C:\Windows\SysWOW64\net.exe
                                                              net stop "Kingsoft AntiVirus Service"
                                                              3⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4088
                                                              • C:\Windows\SysWOW64\net1.exe
                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5476

                                                        Network

                                                              MITRE ATT&CK Enterprise v16

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              $$a906F.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a906F.bat
                                                              • Size 722B
                                                              • SHA256 e0393b842d0fa32ce97c0ac3588c36b452a68e413a9c629b66aec556c831d29d
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$a966A.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a966A.bat
                                                              • Size 722B
                                                              • SHA256 c3f0eaba6b60fb13e874532583899c537d82e22761782889b474f6e905429bd7
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$a9929.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9929.bat
                                                              • Size 722B
                                                              • SHA256 4fd6b62a1dd59347a5c012bd9d6eb68f38cfc925f3a9cb06b1b06efe6ec88ac8
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$a9BF8.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9BF8.bat
                                                              • Size 722B
                                                              • SHA256 a9d0880a3879f47105031f33df069cc808102e72c17fea247c574c02e2936845
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$a9EF5.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9EF5.bat
                                                              • Size 722B
                                                              • SHA256 3d6e4d19c7b9d115740f2ab5b6aef4dc0dd65d77eab0d3b507a5beed19a80ff7
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$aA0E9.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aA0E9.bat
                                                              • Size 722B
                                                              • SHA256 a2356b2a6305e27300a9cc1d0e1f4c05d2470a81223eeb1bcba76b83572a34bb
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$aA34B.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aA34B.bat
                                                              • Size 722B
                                                              • SHA256 4400511eb594599880df42398d626538448dfc256ff138028c68f3faf95b3ac0
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$aA5EB.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aA5EB.bat
                                                              • Size 722B
                                                              • SHA256 bf2336969a4b01d84d2dc39f605c04322e08f8638f0767f9bfe7d9b37dbfc34c
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$aB0D8.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aB0D8.bat
                                                              • Size 722B
                                                              • SHA256 7c89f5b4c0244d81d82bc4dfeabb9cbab6d9d211a0f4272819775a3b0eec5769
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$aB56B.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aB56B.bat
                                                              • Size 722B
                                                              • SHA256 13ea537e690c63c068bc220e63e5a000b5539bc2c0a58aa90b346dd242214220
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$aB77F.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aB77F.bat
                                                              • Size 722B
                                                              • SHA256 003c644ceb5403a72d1afdda2acf1b4d23888cfc48e3870005f82c69e1f9e7bd
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$aBDE7.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aBDE7.bat
                                                              • Size 722B
                                                              • SHA256 39fff350ccc30a37ebaeb04a7ca4f248ba0a1e8a9adae833d6a30deb4213e204
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$aBFDB.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aBFDB.bat
                                                              • Size 722B
                                                              • SHA256 5a987e996b9ee565861ec947f2b83e95bc08f157e90752d1810f2559c96f3318
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$aC28B.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC28B.bat
                                                              • Size 722B
                                                              • SHA256 0210b7bdeeb608c01c1eb112ad68e021af2dcd61ad2a6cd7c97b14347f4f90f6
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$aC3B4.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC3B4.bat
                                                              • Size 722B
                                                              • SHA256 b4b6ddb20bf4fa51db31e4ea87697b661a6c87bd691096a69bd59e0317abefe6
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$aC5C7.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC5C7.bat
                                                              • Size 722B
                                                              • SHA256 e5ea0ea1ed6a45e844d17f45417307c73799d682b7e2c9fc90185f6af5783ca0
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$aC7DA.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC7DA.bat
                                                              • Size 722B
                                                              • SHA256 f85a83261146556d518c8f3750684375e395463344deeb65b26a7ff4e5348a2f
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$aC9CE.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC9CE.bat
                                                              • Size 722B
                                                              • SHA256 e5fd24727f3664912bb41a135c8529ca16b6ea3534046514f57d657fc29160c8
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$aCB64.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aCB64.bat
                                                              • Size 722B
                                                              • SHA256 fe6c25f6ef74de0b2565404604b4684849f522c1443cf2353511d276f91f3486
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$aCDB6.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aCDB6.bat
                                                              • Size 722B
                                                              • SHA256 0b31809c5786ebc3ed256fd59fe129f0b2a504794cbdc57d6bdb62a13263c9a1
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              $$aCFBA.bat
                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aCFBA.bat
                                                              • Size 722B
                                                              • SHA256 e663a00e0502ee41dac1fddf4595eb73458afb3b77f8c17c08ab4b91d9c87ffb
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 2.7MB
                                                              • SHA256 e2d5b5f351df2a83b9080861cbc956d28861ee40279a0794ecdb53f9c3631072
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 2.6MB
                                                              • SHA256 4ffdbc93b7e0ebf06b8ff65e3dce3012a440e40800e93d86e35baef25a964aca
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 2.8MB
                                                              • SHA256 4972254cdf3ec0623aa0b27b02f8f83935fe318d5f37bd93a75f731430f6ce03
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 2.6MB
                                                              • SHA256 546bcd4b1acc2eec87728808fae619d348ef9517f11d24b226a6eba14a15cea8
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 2.7MB
                                                              • SHA256 2d995d00bee5ad50886ca41385cae6c55f259931f7c5340826624068075b404b
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 2.5MB
                                                              • SHA256 38ba535f483c8dd3bb916b0824910ffe63f46ebeb0ab2ee20fe830e913c06a27
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 2.9MB
                                                              • SHA256 be9e13ca189bb685788a1e30f6c66179b0b48b7939cdaf592d8e2f8876b226f5
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 2.7MB
                                                              • SHA256 d8caafe80e29d5d92f38ab8c4e5ea7c5476d3cbf4a2a071e85e2ad996dadd376
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 2.4MB
                                                              • SHA256 f29532ecb00e8412ee54f3da67aa070bef1283ef028ce73d502ed35d89ed9018
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 3.1MB
                                                              • SHA256 9d977c3989edd4f6e81ce959aafa86ab85af8896fa82c8d74ef4b88c80d788ee
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 3.0MB
                                                              • SHA256 4df32b7fcdfddd7f792109bc8c2d6defec0b34f9b8df81d37ee198698cce74b0
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 3.0MB
                                                              • SHA256 aa2519b9e27f62b7b9228ee803b3c8de25f6744f74ddabe8ab0009388f4e2a5d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 2.9MB
                                                              • SHA256 cd01df41c798306b0359a00433e20a1473d10dbb7998e54d5d202917b218349a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 2.6MB
                                                              • SHA256 d8fb3d092c847bf9f379b685bc27758915c593aa65b0c6c71deb82cd685b26ad
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 3.0MB
                                                              • SHA256 8fdc7bbf871177604ad3b786b76819565e66238c52aa559a2e5d64b16f25311c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 2.5MB
                                                              • SHA256 411b5ff4c7ef3ae8bfe54391688bacd87604858d0110c0c706bdffba6bfc2275
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 2.9MB
                                                              • SHA256 78fcdec4b5b2d0ac2cea67246f3aaec5c204bdf7673c168e3ec482eeae3c2159
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 2.5MB
                                                              • SHA256 c0a73aeb6291367a371c9a6c6d98ee5f24ceb1cd168a790fcc267597ff4a4e77
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 2.8MB
                                                              • SHA256 274c26804e210c6aac0110ef219a1ccf07796f98127f7fcd6ed57a32c1d98c7f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\31c270fde6365f1ef60f6e694210f906106768e0fdfafb34074058f5b384c380.exe.exe
                                                              • Size 2.8MB
                                                              • SHA256 230df766ce5e6332f966675d2656cc5ce2a5b36e1fb2183bc896b72252738962
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Logo1_.exe
                                                              • Path C:\Windows\Logo1_.exe
                                                              • Size 32KB
                                                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              _desktop.ini
                                                              • Path F:\$RECYCLE.BIN\S-1-5-21-461973139-3212354679-1508698038-1000\_desktop.ini
                                                              • Size 9B
                                                              • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              memory/200-2605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/236-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/692-2821-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/848-2480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/916-2432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/952-86-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/1088-2857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/1132-2725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/1272-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/1348-2701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/1380-2655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/1396-2906-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/1408-2863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/1448-2523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/1512-2686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/1876-2502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/1892-2650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/1940-2887-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2032-2518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2388-2749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2408-2575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2420-2815-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2520-2600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2580-2630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2584-2785-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2720-2590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2740-2528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2756-2645-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2764-2681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2768-2440-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2788-2737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2804-2472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2832-2912-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2900-2580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2904-2875-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/2928-2559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3024-2803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3056-2488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3204-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3204-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3264-2533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3280-2676-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3292-2544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3324-2743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3360-2845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3364-2539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3388-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3532-2713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3552-2640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3616-2570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3740-2660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3844-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3916-2773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/3924-2512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4036-1549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4044-2893-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4108-2869-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4160-2833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4236-2809-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4240-2731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4280-2595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4324-2620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4344-2456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4408-2881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4524-2665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4548-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4580-2625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4592-2464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4596-2615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4656-2635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4712-2585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4720-2779-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4804-2719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4808-2329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4808-2503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4808-879-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4808-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4864-2424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4920-2696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4952-2565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/4980-2900-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5076-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5128-2666-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5128-2560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5160-2691-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5228-2851-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5236-2496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5332-2761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5352-2549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5360-2554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5388-2839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5428-2767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5528-2755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5572-2671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5616-1865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5664-2702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5688-2610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5760-2707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5872-2448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5912-2827-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/5984-25-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/6028-2791-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download

                                                              memory/6044-2797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                              Download