Overview

overview

8

Static

static

3

1c8c9303b1...7f.exe

windows10-2004-x64

8

1c8c9303b1...7f.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 17:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
  • Size 4.5MB
  • Sample260930-v5fe1avflb
  • SHA256 1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
    "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4136
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB339.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5216
      • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
        "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4480
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB711.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4836
          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:1184
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBD4.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5116
              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2184
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEA3.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5060
                  • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                    "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:5948
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC356.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1072
                      • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                        "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1132
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4DD.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:4104
                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:2676
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC78C.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3524
                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:5768
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD49.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:1612
                                  • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2552
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD816.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1364
                                      • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:3708
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB33.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:2328
                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:3196
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE64F.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:4256
                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:4532
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE97C.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2960
                                                  • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4652
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED06.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2684
                                                      • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1424
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF052.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:560
                                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2700
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF38E.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2484
                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4312
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF61E.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2236
                                                                  • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5448
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8FC.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3340
                                                                      • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4244
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC19.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:6132
                                                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5024
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEA9.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:464
                                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5784
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a188.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4796
                                                                                  • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1244
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E0.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4672
                                                                                      • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2644
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DA.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:52
                                                                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5108
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a541.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2812
                                                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2816
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a679.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4880
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:6072
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E1.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4536
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1084
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a948.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5444
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5696
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA90.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2296
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4980
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8A.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5884
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5856
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC94.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:5980
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:5688
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7E.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:3168
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:4272
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE78.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:3460
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:1296
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF92.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:1292
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:3852
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a107C.bat
                                                                                                                                      66⤵
                                                                                                                                        PID:2680
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:1468
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1186.bat
                                                                                                                                            68⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5776
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:300
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1280.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:3480
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:5520
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a135A.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:2880
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:4240
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1464.bat
                                                                                                                                                        74⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:1756
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:5268
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a151F.bat
                                                                                                                                                            76⤵
                                                                                                                                                              PID:1820
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:3036
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1629.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:5616
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:3088
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1723.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:2300
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:4092
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a182D.bat
                                                                                                                                                                          82⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:5792
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                            83⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:5504
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1927.bat
                                                                                                                                                                              84⤵
                                                                                                                                                                                PID:2888
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:4772
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A30.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:3596
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:1308
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B1B.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                          PID:5576
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:1276
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C15.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:1124
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:5252
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CD0.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                    PID:2808
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:1136
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D8C.bat
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:5720
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:3888
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E57.bat
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                              PID:5836
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:3232
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F32.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                    PID:4288
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:4604
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a200C.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:5592
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:1352
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20D7.bat
                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                              PID:5408
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:2920
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21C2.bat
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:5264
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:4324
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a229D.bat
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                        PID:5796
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:3084
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2368.bat
                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:3772
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:2696
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2423.bat
                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:1420
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:3224
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a250E.bat
                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                      PID:1448
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:3012
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25F8.bat
                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:4904
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:1300
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26E2.bat
                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:3564
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:1708
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27EC.bat
                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                    PID:3832
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:6044
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28B7.bat
                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:4108
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          PID:5432
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29A1.bat
                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:2488
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:2116
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A5D.bat
                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:3476
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:5284
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B57.bat
                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:260
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                        PID:1392
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C9F.bat
                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:4504
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:1496
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D89.bat
                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:544
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                  PID:2624
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E74.bat
                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:3204
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:5456
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F3F.bat
                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                          PID:2152
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                              PID:3300
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a301A.bat
                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:4512
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:2800
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30B6.bat
                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:4908
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:4712
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3171.bat
                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:3552
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:768
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a325C.bat
                                                                                                                                                                                                                                                                                                                            142⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:5640
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:3092
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3317.bat
                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:5080
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:2916
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33E2.bat
                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:5804
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:1848
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a348E.bat
                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:5900
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:2192
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3559.bat
                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                              PID:6048
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:3488
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3615.bat
                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      PID:1900
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36E0.bat
                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4560
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:6032
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37CA.bat
                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1688
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2344
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38F3.bat
                                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:3520
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:5984
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39CE.bat
                                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:236
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:1152
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AB8.bat
                                                                                                                                                                                                                                                                                                                                                                              162⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1356
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:5480
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B84.bat
                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:2348
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:5312
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C4F.bat
                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4448
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3512
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D1A.bat
                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E04.bat
                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EDF.bat
                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:716
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4075.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:968
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4140.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a421B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42E6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a444E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4528.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45E4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a476A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4845.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4901.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AB6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B91.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C5C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D27.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DF2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E9E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F5A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a514E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5277.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5332.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53DE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5499.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5536.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a569D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5749.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5804.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58C0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a595C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A27.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AB4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B60.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CF6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4864
                                                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                                                          24⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                          PID:5584
                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                            25⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                            PID:1368
                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                              26⤵
                                                                                                                                                                                PID:1604
                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                2⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Enumerates connected drives
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:2468
                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                  3⤵
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:5928
                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                    4⤵
                                                                                                                                      PID:5680
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 1008
                                                                                                                                    3⤵
                                                                                                                                    • Program crash
                                                                                                                                    PID:1232
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2468 -ip 2468
                                                                                                                                1⤵
                                                                                                                                  PID:1152

                                                                                                                                Network

                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      $$aB339.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB339.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 d23e0bb6eaf728ff60ee8a0e87e65d5c8230dbe0d956457bfd8f90af437a9d55
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$aB711.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB711.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 40d2076e9eda60d2ea3c36e97c465799a72f810dcd033dceb68d3432f695d209
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$aBBD4.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aBBD4.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 4c65e2b86a2e7e939e347ab15996cf51846074f673be92ba00ad03f8d5a943e8
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$aBEA3.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aBEA3.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 ba714e3cbb27843ce6f2ae7688ac495aaebd129e568fa70960ba4218f500f09c
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$aC356.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aC356.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 9085e26275ec4a82a7a80e801f01e783816e4b2aae5c0b2dbf56df861b00ceb0
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$aC4DD.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aC4DD.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 c43eeb24fe0b5461d00e967dc55ab651ad11bfa7de973eaac9470ac9d24c0287
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$aC78C.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aC78C.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 f534ae257e72d9b3dcdc4f4156f04be2bf32091cb88ea1ea1440096d0629d2a6
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$aCD49.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aCD49.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 d4be55f2d632b54ee6a32e516c877445500ad1c9d0d99b4973accd03471d783a
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$aD816.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aD816.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 95ae1df8578713caf5da1661dd115f081668094ef3639414654fc6a11ced222e
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$aDB33.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aDB33.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 a8515b54cf1b9c9867469df2fe9bca7ef82c56933c27dc2aae90bc7c47dd5c85
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$aE64F.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aE64F.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 062699315cfff6f7912a7f7ba2aeef6f6d3458b826e96ff1b76ba53f96d73e20
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$aE97C.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aE97C.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 afde2bdc5ade13fc34d19ce5f79d3e86c5bf9590d53525f4415abc5e40a9e405
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$aED06.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aED06.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 a3f0d38d530b82f9bfc65b1b6e8583537f48dd85a2be979be1465992a30a3be4
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$aF052.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aF052.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 a57956276e1c20d8918affdeb34ccfeba5a0510bb6b8ad9fa7aaadf45c4e9c70
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$aF38E.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aF38E.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 e305d2391b19813d4467f5b435757e9aae39bbe970794095fa3c23286cddd139
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$aF61E.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aF61E.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 b732308092ddb3baff43a5b055a8491076831afedfe2bdbb64532cd467ba94bd
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$aF8FC.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aF8FC.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 d141e7f4789fbf8c6d6c54b3507aa4c8563cbc5853e0abd3e731834414e56151
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$aFC19.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aFC19.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 40732a6bf07083162cca9978ed6e502ee03ee36280db79fff18016c86fe2f56f
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 4.1MB
                                                                                                                                      • SHA256 e422e66eec5f2034835aa6730ebd5df053c06a48ca01aff547c2389cb1a74261
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 4.2MB
                                                                                                                                      • SHA256 f6008bb22fd7ee73d87597c7bf3bce9c8891d24d99c2aac3620c7e83f49daa57
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 4.1MB
                                                                                                                                      • SHA256 b296bc3cf042383863860f99290e93571d6d7d0d5c5b3e5d9b624bc5ee9863da
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 4.3MB
                                                                                                                                      • SHA256 d47b9146023635dda8ad7051ccfceadffa1708ae7b81f85566142e5a50f3ec0e
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 4.2MB
                                                                                                                                      • SHA256 3c1061aa99a45848a9065f305687036421c85aa3d4f5ce8a82d35c5f67d25457
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 4.4MB
                                                                                                                                      • SHA256 ed19b83bba578d3ba308321d88b2b963e4f3ec1e49f05efffd2aa484b188b5c3
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 4.4MB
                                                                                                                                      • SHA256 a34a43f43982e2f3fbfcd72d765d32b6b14aaf1066457cbeedcab16178d9bd0a
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 4.4MB
                                                                                                                                      • SHA256 43c354f4c45f7708f4fdf3db82a653a0ac19ebd0777ab085d4c252d5ac4952a8
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 4.2MB
                                                                                                                                      • SHA256 4d21c790b5ac35517cfc4a0087ebdca6dd4cb5eb2fdfa615cffe0d2852de4a5e
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 4.2MB
                                                                                                                                      • SHA256 54ff08baef2fb0115722599e915f2f9a38469ea50e6a25f537ccb10d9c409031
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 4.3MB
                                                                                                                                      • SHA256 bdfdfe812c5d36c953159db2d862fee295dcf886e1e17efe3a37825645fc268c
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 4.1MB
                                                                                                                                      • SHA256 d3c3f7aa6e4ba8d4492e6970e2c496955128a6f5862b90408d41e45ad79fc710
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 4.0MB
                                                                                                                                      • SHA256 74b81e57ab7453ad5b382880e3af3f48f4110865a0a00497a73eb969a0ed0319
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 4.3MB
                                                                                                                                      • SHA256 9c4c01c56482f83a07e0cf8d13d07e7ff77490fa87d66a62fe04c75a8c026774
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 4.0MB
                                                                                                                                      • SHA256 e3b76cc2f3a9c5e865decbd59670ce5ca68c8d48b2be5db25b986fcdea649d1e
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 3.9MB
                                                                                                                                      • SHA256 f0162cfa4e538dac9fa0bfe13a29ff80a37cdfe879ef89b7ec304e4442451347
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 4.0MB
                                                                                                                                      • SHA256 e83130bd8e03bcc86799735e7c4d79be5c0be43767abf5de60a7154dcecfbb6a
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1c8c9303b1ae3706136b54ccb5f2c634c4ce3a1435791f8fcd247277a87de07f.exe.exe
                                                                                                                                      • Size 3.9MB
                                                                                                                                      • SHA256 b9c9caa6fe0fc59033b247fa7542c0fabeb45ce9d04ca890479c1a63a2ab5668
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Dll.dll
                                                                                                                                      • Path C:\Windows\Dll.dll
                                                                                                                                      • Size 68KB
                                                                                                                                      • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Logo1_.exe
                                                                                                                                      • Path C:\Windows\Logo1_.exe
                                                                                                                                      • Size 32KB
                                                                                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _desktop.ini
                                                                                                                                      • Path F:\$RECYCLE.BIN\S-1-5-21-1404337215-1550464601-2805570857-1000\_desktop.ini
                                                                                                                                      • Size 9B
                                                                                                                                      • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                      Submit Download

                                                                                                                                      memory/300-2854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/404-3248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/768-3043-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1084-2807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1116-3368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1132-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1136-2914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1152-3104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1184-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1244-2781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1276-2904-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1296-2838-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1300-2969-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1308-2899-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1328-3242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1352-2934-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1380-3146-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1392-3001-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1424-2729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1468-2849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1496-3007-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1520-3176-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1624-3182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1708-2974-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1848-3061-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1900-3079-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2116-2989-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2184-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2192-3067-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2344-3092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2468-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2468-2694-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2468-667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2468-1853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2492-3350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2552-1849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2584-3302-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2624-3013-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2644-2787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2676-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2696-2954-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2700-2739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2736-3152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2772-3134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2784-3296-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2800-3031-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2816-2797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2916-3055-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2920-2939-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2936-3128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3012-2964-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3036-2874-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3084-2949-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3088-2879-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3092-3049-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3196-2662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3224-2959-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3232-2924-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3264-3356-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3300-3025-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3364-3212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3420-3266-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3488-3073-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3504-3290-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3512-3122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3556-3326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3708-1858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3756-3308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3852-2843-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3884-3332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3888-2919-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4080-3200-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4092-2884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4100-3375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4100-3381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4128-3236-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4136-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4136-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4188-3206-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4240-2864-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4244-2763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4272-2833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4304-3140-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4312-2747-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4324-2944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4396-3284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4412-3164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4416-3314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4428-3158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4460-3344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4480-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4528-3188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4532-2708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4540-3374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4604-2929-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4652-2719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4712-3037-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4744-3362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4752-3254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4772-2894-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4824-3320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4980-2817-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4996-3338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5024-2818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5024-2771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5108-2792-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5252-2909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5268-2869-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5280-3278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5284-2995-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5312-3116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5340-3230-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5344-3194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5360-3272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5432-2984-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5448-2755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5456-3019-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5480-3110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5504-2889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5520-2859-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5584-2844-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5584-2782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5600-3224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5688-2828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5696-2812-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5768-379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5784-2776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5856-2823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5892-3170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5948-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5984-3098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/6000-3218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/6032-3085-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/6044-2979-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/6052-3260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/6072-2802-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download